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Detachable Summary 





The U.S. energy system is highly vulnerable to large-scale failures with catas- 
trophic consequences, and is becoming more so. This study analyzes the origins 
of that vulnerability, both generically and specifically. We conclude that 
America's energy insecurity stems from the nature, organization, control struc- 
ture, and interconnections of highly centralized technologies. These technolo- 
gles--which unfortunately dominate both the present energy system and current 
national policy--cannot withstand terrorism, sabotage, enemy attack, natural 
disaster, or even accidental technical failure. The resulting brittleness of 
energy supplies poses a grave and growing threat to national security, life, and 
liberty. It also frustrates the efforts of our Armed Forces to defend a country 
whose energy supplies can be turned off by a handful of people. 


Energy is more than oil, and energy security is more than ability to keep the 
oil coming. Although current inability to guarantee oil supplies is a serious 
problem, previous analyses of energy security have focused all but exclusively 
on oil, and have therefore diverted attention from a more comprehensive under- 
standing of how to achieve energy security. Since, moreover, Federal energy 
planning does not consider vulnerability as a criterion, many policies proposed 
to reduce dependence on imported oil are actually making energy supplies more 
vulnerable in other and even less tractable ways. Conversely, opportunities for 
Simultaneously reducing oil dependence and other energy vulnerabilities are 
being ignored. 


This analysis, addressed to a general policy audience with basic numeracy, and 
to energy and preparedness professionals, seeks systematically to identify ard 
apply those design principles that can make America’s energy system more resil- 
ient, less vulnerable, less susceptible to catastrophic failures: in short, to 
make the nation better prepared for all kinds of disruptions, whether civil or 
military, foreseen or unforeseen. This study shows why traditional measures 
designed merely to make energy supplies more reliable in the face of calculable, 
predictable kinds of technical failure cannot achieve such basic resilience and 
may even reduce it. In contrast, by drawing on such areas of design as biology, 
telecommunications, data processing, nuclear engineering, and aeronautics, we 
identify practical design elements, technologies, and principles of system 
architecture which can make catastrophic failures structurally impossible. 


The most cost-effective approach embodying these principles is to increase 
dramatically the efficiency of using energy. This displaces the most insecure 
marginal supplies, stretches time constants, shaves peak loads, Limits extremes 
of system behavior, and greatly increases the scope for improvised supplies. 
The next priority is to harness a wide range of presently available, relatively 
dispersed, renewable sources whose scale, location, and energy quality are 
appropriate to their task. In combination, and with due attention to some 
currently ignored details of design, technologies for high energy productivit: 
and appropriate renewable supply would provide an inherently resilient energy 
system, with profound benefits for individual and national security. 


It is thus encouraging that these two types of measures are today respectively 
the cheapest and second-cheapest, and the fastest-growing and second-fastest- 
growing, contributors to national energy supply. They would spread even faster 
in a truly competitive marketplace or with greater reliance on individual and 
community initiative (some grassroots efforts to mobilize such resilient techno- 
logies are already underway). This analysis thus concludes that an energy poli- 
cy consistent with free-market principles can provide lasting energy security 
for a free society--if the foundations of that security are clearly understood. 
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PREFACE: PURPOSE, METHOD, AND SCOPE 





The first comprehensive oversight examination of Federal efforts towards 
nonmilitary emergency preparedness opened its report [Joint Committee on 
Defense Production 1977:I-vii]* with this finding: 


An increasingly complex, technology-dependent, industrial economy in the 
United States has made citizens more than ever vulnerable to the effects 
of disasters and emergencies over which they have little or no control and 
to which they cannot successfully respond as individuals. 


Most modern systems for supplying energy carry in their design the seeds of 
this brittleness: complexity of components and structure; highly interact ive 
and poorly understood system behavior; likelihood of unexpected, unpredictable 
disturbances; difficulty of diagnosing, repairing, and replacing disabled 
parts; pronmeness both to exacerbate and to be disrupted by sociopolitical ten- 
sions and instabilities; potential for sudden failure on a massive scale; and 
profound importance for well-being, social cohesiveness, and national survival. 

Our nation has invested enormous resources in military measures to deter 
and defeat aggression, and to project U.S. power abroad to guard perceived 
national interests. Yet at the same time, we have made both this military 
might and every facet of our civilian life dependent on an energy system inher- 
ently vulnerable to large-scale failure, whether caused by accident or by 
malice. We have developed a society, for example, in which the basic functions 
of life depend on a continuous supply of electricity. In New York City, trav- 
eling, going upstairs, opening doors, even walking, eating, seeing, and breath- 
ing often depend on the electrical supply. Just a brief faltering of such 
services as electricity, gas, food, water, and sewage treatment can manifest-- 
sometimes fatally--the latent brittleness of our interdependent, urbanized 
society. Yet the systems that provide these services seem increasingly to be 
so ordered as to magnify, even perhaps to maximize, that vulnerability. 

Our electrical systems, for example, depend on many large and precise 
machines, rotating in exact synchrony across a continent, and strung together 
by an easily severed network of aerial arteries. Electricity cannot be readily 
stored in bulk, so failure is instantly disruptive. Failure also becomes more 


damaging and less tractable on a large scale. The very size and complexity of 





*Throughout this report, bracketed citations refer by author and date, and if 


needed by volume and page number (after the colon), to consolidated references — 


listed alphabetically starting on page 280. Occasional omissions of citations 
are generally to protect a specific point of vulnerability from being identi- 
fied or to honor a source's wish that a statement not be attributed. 
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modern power grids, their reliance on elaborate control and communications sys- 
tems, even the inherent electrical properties of long transmission lines, tend 
to increase the likelihood and consequences of major failures. There “is lit- 
tle doubt" that a few high-altitude nuclear blasts, perhaps even one, “could 
black out all U.S. power grids" [Lerner 1981:43]. Even more strikingly, we 
have now reached the point where a handful of people with rifles may be able to 
turn off virtually the whole country. Such homemade threats to our national 
security appear to undermine the mission of our Armed Forces, and would be a 
grave preparedness problem even if our nation had no adversaries in the world. 

This study explores in detail the validity of such concepts as a linkage 
between energy vulnerability and central electrification. By exploring those 
technological and architectural features which make the energy system brittle, 
the analysis seeks to identify and reduce to specific, practical form those 
design principles that can make our energy system more resilient, less vulner- 
able, less susceptible to catastrophic failures: in short, better prepared for 
all kinds of disruptions, whether civil cr ailitary, foreseen or unforeseen. 

The motivation for tackling this difficult, seemingly amorphous subject is 
the unpleasant discovery, on reviewing the’open literature, that: 

- Comparative vulnerability has been analyzed only in a very narrow sense. 
There is no conceptual framework for assessing vulnerability to a full range of 
potential disturbances. Many existing methodologies are misleading, because 

- Most analytic and design efforts seek reliability against calculable 
technical failures, but this does not impart, and may even reduce, resilience 
against incalculable or unexpected disruptions, especially deliberate ones. 

- Comparative vulnerability is seldom even considered as a criterion in 
Federal energy policy decisions, whether by the Congress or the Executive. 

- Technologies and system designs that offer the greatest potential im 
provements in preparedness (together with other important advantages) generally 
have been least analyzed, and have lowest priority in current Federal policy. 


- Most trends in Federal energy policy appear to be increasing vuinera- 





bility, often in the name of reducing it: specifically, many of the systems 
proposed to displace imported oil are themselves subject to other and arguably 
graver security drawbacks. 

- Preparedness policies, though growing beyond their traditional emphasis 
on the threat of nuclear attack, remain inadequate to mitigate threats posed by 
the increasing structural vulnerability of the U.S. energy system. 

- In particular, although energy preparedness analyses and policies have 
been almost completely directed towards coping with reductions or interruptions 


of oil imports, many other forms of energy vulnerability--less obvious but per- 


haps even more dangerous--have been largely neglected. 














viii 





These other, wider vulnerabilities form the main (though not the exclusive) 
focus of this study. The Secretary of Defense's statement [Brown 1977] that 
“there is no more serious threat to the long-term security of the United States 
and to its allies than that which stems from the growing deficiency of secure 
and assured energy resources..." is true in a far broader sense than he presum 
ably intended; and this study seeks systematically to explicate that sense. 

The o1l problem is real, difficult, and urgent. Even if oil reserves were 
unlimited, their proprietors permanently friendly and reliable, and their 
delivery systems permanently secure from interference, there would be serious 
national~-security problems just from the enormity of our oil import bill. 
During 1979-80, while U.S. oil imports fell by about 20%, their cost rose by 
nearly 50% to almost $90 billion--equivalent, as John Sawhill put it, to the 
total net assets of General Motors, Ford, IBM, and General Electric, or to 
nearly 40% of all U.S. exports. But in fact, oil reserves and resources are 
Limited; many of their main proprietors are neither friendly nor reliable; much 
of the supply Line stretches halfway around the world; and “every main oil 
Loading port in the Persian Gulf and mst of the Saudi Arabian and the United 
Ara Emirates oil fields are within 900 miles (a 90-minute subsonic flight) of 
the Soviet Union” (and closer still to Soviet facilities in Afghanistan and 
elsewhere’ (U.S. General Accounting Office 1979:3]. "In the event of some 
future confrontation, the Soviet Union might be able to restrict access of the 

Western World to its essential oil supplies to a degree of severity and dura~ 
tion greater than any embargo by the oil producers....{[A]ction to interdict on 
the high seas tanker movement of oil...could vastly exacerbate the oil supply 
situation...."(Brown 1980] 

There is a consensus that despite mich effort, oil vulnerabilities remain 


unacceptably Large (Emergency Preparedness News 1980; Deese & Nye 1981; Yorke 





1980; Alm 1981; Marshall 1980; Senate Committee on Energy & Natural Resources 
1980; Aspen Insticute 1980]. Our thesis, however, is that energy is far more 





than oil, and energy security is far more than ability to keep the oil coming. 





Thus even if the oil problem is solved, major and unexamined energy vulnerabil- 
ities will remain. Many measures being used to "solve" the oil problem will 
indeed make those other vulnerabilities worse. Other measures not now being 
implemented could probably provide both greater relief of oil dependence and 
more comprehensive energy security. This report's emphasis on vulnerabilities 
other than imported oil, then, arises not from a lack of concern about the oil 
problem, but from an even deeper concern that the whole problem of energy pre- 


paredness has been misconceived. Though discussions with people professional- 


ly concerned with preparedness have consistently elicited intense interest in 











this thesis, the urgency of the oil problem has so confined analysts’ attention 
that there is virtually no literature directly bearing on these concerns. With 
the exception of ome project now underway at FOA (the Swedish Defense Research 
Establishment), there appears to be no comparable analysis anywhere in the 
world. Our investigations also revealed that although some individual analysts 
in the Department of Energy think about pieces of the vulnerability problem, 
the Department as an institution has not yet seriously considered the broader 
preparedness implications or the inherent vulnerabilities of energy systems 
being promoted on other grounds. This report seeks to begin to fill that broad 
and important gap, even if in a preliminary fashion that can doubtless be 
refined by those with greater knowledge and resources. 

The Federal Emergency Management Agency has already sponsored a parallel 
study [Energy & Defense Project 1980], carried out independently of this one, 
which might at first sight appear to have covered its concerns. That work is 
helpful and relevant but largely complementary to the line of this analysis. 

It offers an opportunity to avoid possible overlap by simply citing mich of its 
material--notably its readable exposition of the status of various renewable 
energy sources--but this report aims at considerably deeper conceptual analysis 
of energy vulnerability end resilience. Both studies seek to address FEMA's 
need to find out more abour emerging technologies and energy-system design 
principles that can enhance preparedness, and to alert FEMA to actions that may 
be needed to ensure adequate attention to preparedness in formulating energy 
policy. (Much of this study should also help FEMA in its counter-terrorism 
consequence preparedness planning.) But where the Energy and Defense Project's 
efforts are directed more towards a survey of available technologies, this ana- 
lysis, while including ample technological material, will also seek to systema~ 
tize in far greater detail some design principles for energy resilience. 

This study is of necessity exploratory and conceptual. Because the probd- 
Lem as framed here has not been systematically studied, it has been necessary 
to synthesize ideas from an extensive survey of many diverse Literatures (some 
in subjects not normally considered in research of this kind) and from dozens 
of interviews and letters, together with a good deal of hard thinking. The 
present treatment uses quantitative expression where it will illuminate rather 
than obSCure quaiitative insights, but avoids opaquely elaborate computer 
models of concepts better kept in words: much of the argument simply does not 
lend itself to formal modelling so mich as to analogy and anecdote. Some sec- 
tions require modest technical background to follow in detail, but mst are 
written for a general policy audience with basic numeracy. References are also 


supplied to enable specialists to dig deeper if they wish. 














To do justice to the richness of the concepts of vulnerability and resil- 


lence, and to organize systematically a large mass of supporting examples, it 


proved necessary to rearrange the sequence of topics originally envisaged in 


the contractual Statement of Work, developing the same subjects in an order 


better suited to the intellectual structure of the argument. 


For the reader's 


convenience, the following key shows how the topics in the Statement of Work 


(Clause 101. General Scope) correspond to sections of the text: 


af sas egtiLes 
“(a) Conventional energy sources as well as the new emerging energy techno- 


Logies pose substantial public risks both in normal operation and as targets 


for sabotage. 


The potential positive and negative events which may derive from 


traditional and new sources of energy have not been identified or analyzed. 
"(b) Current civil preparedness policies m2zy not be adequate in mitigating 


the possible adverse impacts of alternative energy technologies. 


research will include the following: 
"2. Specific Work for Services 





“The contractor shall...conduct an impact analysis of 
alternative energy techrologies to include but not be 
Limited to the following: 

"(a) Identify and analyze the risks and benefits in- 


"(b) 


herent to conventional energy technologies and 
their potential vulnerability to natural and man 
made disasters (including enemy attack) industrial 
accidents and sabotage. 

Identify and analyze the risks and benefits of 
emerging renewable energy technologies and their 
potential vulnerability to natural and man made 
disasters (including enemy attack) industrial 
accidents and sabotage. 


"(c) The(se] analyses...will include but not be Limited 


"(d) 


"(e) 


to such factors as identification of fuel types, 
delivery methods, 

distance and risks of distribution networks, 
ease of storability, 


ease of operation and repair, 
and adaptability to alternative fuel sources 
and cost-effectiveness comparisons. 


Identify and analyze the potential economic, social 
and political tmpacts of emerging, renewable energy 
sources. 

Review and discuss civil preparedness policies 

to determine their applicability and effectiveness 
in mtigating the possible adverse impacts of alter- 
native energy cechnologies. Consideration will be 
given to the emerging set of policies associated 
with renewable energy technology.” 


The proposed 


Chapter(s) 





i-3 


2.1.8,2.2.2°3, 
5- 


2.1.5,3.2,3.3.1 
2.1.4,2.1.7,3 
2.1-2,2.4,3 
2.1.4,2.1.6,3, 
6.2-3,7.1,7.2.3 
2.1.7,2.2-3,6.2- 
3,7,8 
2.1.5,4.4,6.2=3, 
7.3.2 
$.2,6.1,6.4=5, 
7.2.1,7.3.1-2 
2.1.2-3,2.1.10, 
4.4,6-8 
2.3,3.4.4,4.4, 
$.2.10,6.3, 
7.2.3,8 


To ensure a coherent understanding of how these subjects interrelate, however, 


the reader is urged to study this report as a whole and in its proper order. 
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Any analysis of vulnerabilities must be carefully framed in order not to 
provide a manual for the malicious. Every effort has been made here to omit 
those concepts and technical details which would be useful to a saDoteur with 
sufficient skill and insight ts be effective-in the first place: that is, the 
material presented is meant to be grossly insufficient to help persons who do 
not have such 2.11 and superfluous to those who do.* Some residual risk will 
monetheless remain--perhaps the price of free and informed discussion in a 
democracy. We believe the only thing more dangerous than discreetly discussing 
these distressing matters is not discussing them-—-hence leaving the real dan- 
zers to be enshrined in public policy and exploited by ingenious malevolence. 

The boundaries of this analysis exclude, among other important topics, 
U.S. defense and military policy; most of the social, political, and psycho- 
Logical dimensions of preparedness [Dresch & Ellis 1966]; save in passing, vul- 
nerabDilities outside the sphere of energy policy; the detailed structure of 
U.S. institutions and policies for preparedness; and the detailed relevance of 
the thesis to U.S. allies or adversaries or to nonaligned (especially develop- 
ing) countries. This report should not be viewed as a fundamental critique of 
U.S. emergy policies on grounds other than their relevance to preparedness. it 
seeks to analyze how energy policy institutions should think aout vulnerabili- 
ty rather than to specify how those thoughts should be embodied in institution- 
al structure. Further, the 1981 change of Administration, the subsequent 
transition period, and the autumn 1981 proposal to abolish the Department of 
Energy complicate any description of Federal energy policy. While broad policy 
principles were enunciated in July 1981 [DOE 198la], it is not yet clear how 
generalities will be specifically implemented nor how certain internal tensions 
will be resolved. Given such flux, this report can only describe synoptic 
trends for the next few years as the Federal energy role diminishes. 

Finally, though we have extensive practical experience of local prepared- 
ness (organizing responses to storms, fires, etc.), we are not experts on pre- 
paredness in the sense in which many FEMA staff are. But from energy policy, 
our main field of professional activity, we hope to offer some insights which, 
while perhaps not in the accustomed Language or mode of thinking of many pre- 
paredness studies, will be fresh and provocative. If this ana. ssis stimlates 
more sophisticated successors which, in a few years, make this cone look primi- 
tive by comparison, it will have succeeded in drawing attention to a grave and 


overlooked threat to both individual and national security. 





*The authors are familiar with this problem through working with reviewers 
at the nuclear weapons laboratories to ensure discretion in certain unclassi- 
fied technical papers, e.g. [Lovins 1980] (reprinted in Appendix 3). 











1. NATIONAL SECURITY AND PREPAREDNESS 





1.1. Preparedness for what? 





sf 


What is national security? The phrase “is at best an ambiguous symbol 
and “tends to change...over time unless defined in terms of basic constructs.” 
According to a Polaris submarine captain turned political scientist, 


It is often used by Congress, the President, the Courts, or individuals or 
corporations to propose or to justify measures not supported by existing 


public perceptions. It is used only less sparingly than the phrase ‘in 
the national interest" which has a built-in attraction for the z2alot, the 
scoundrel, and the patriot alike. [Bucknell 1979:2] 


Despite overuse and perhaps abuse, the term “national security” speaks to 
important and legitimate concerns. Logically, the “basic constructs” defining 
it* should be such supreme interests as life, liberty, and the pursuit of 
happiness or of economic welfare. Derived from such overriding national 
interests or values--and from the principle that one ought never to have to 
choose between them--are corresponding goals, objectives, policies, and policy 
instruments. Thus, world peace might be a goal serving these values; a just 
peace in the Middle East might be an objective through which this goal can be 
realized; maintaining alliance structures, containing Communism, recognizing 
nations’ right to live peacefully within their boundaries, or seeking autonomy 
for displaced peoples might be policies toward achieving that objective; and 
instruments of such policies might include diplomacy, foreign aid, war, trade 
and resource policy, etc. Military force, then, is only a means to serve 
higher ends |Nevins 1979]. But the traditional formulation of national secur- 
ity objectives, vintage pre-1965 or so, frames them as if both threats and 
responses were primarily military. A spectrum of such objectives could include: 

- Maintaining stable, predictable international alignments and fostering 
sound, lasting alliances. 

- Maintaining influence and confidence to mediate others’ disputes peace- 
fully rather than being drawn into them militarily. 

- Seeking a comity between nations and peoples which will minimize the 
likelihood of resort to military means of settling disputes. 

- Retaining in an interdependent world sufficient freedom of action to be 
able to conduct an independent foreign policy that does not require compromise 


between vital national interests. 





"We consider here only concrete elements as opposed to perceptions of nation- 
al security. Such observers as Lasswell [1977] argue that the latter are at 
least as important to the way people and nations behave. 
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- Achieving security from cutoff of vital supplies, such as oil [Collins & 
Mark 1979], food, and key minerals*. 

- Inhibiring the vertical and horizontal spread and the refinement of 
nuclear weapons and other weapons of mass destruction. 

- Reducing the likelihood and consequences of terrorism and surrogate war. 

- Reducing the Likelihood and consequences of direct military attack on 
the territory of the United Statest or of treaty allies. 

The principal preconditioa for achieving these objectives, and for effec- 
tive use of diplomacy, trade negotiations, and other non-military policy instru- 
ments, has long been considered to be military strength. 

Military strength in turn requires reliable access to many resources. Of 
these, among the most important is energy in suitable forms to drive the en- 
gines of war. In World War II, the Allied loss of 550 oil tankers at sea was 
made up by the ability of J.S. industry--then fueled chiefly by coal--to build 
908 more [Bucknell et al. 1979:16]. The coal was domestic; the diversity was 
crucial. In the Suez Crisis of 1956, U.S. oil surge capacity permitted the 
resupply of Europe. That flexibility has since disappeared. 

Vietnam was America's first largely oil-fueled war, and its direct use of 
some 1.1-1.2 million barrels of oil per day--some 9% of total national oil 
consumption, or nearly twice the fraction lost in the 1973-74 Arab oil embargo 
(id. :18-20]--accelerated the rapid shift of the United States to being a net 
Oil importer. Any future wars may have to be fought largely with oil procured 
from foreign countries and delivered in foreign vessels by foreign crews (id.: 
21]. Fighting a replica of World War II today with 90% of our oil imports 
interdicted would require roughly half the nation's total oil consumption 


[id.:22], implying drastic civilian rationing if not worse, and accentuating 





*Many of the energy issues considered in this study apply also to non-fuel 
minerals. Among the more useful introductions to this enormous field are 
{Fishman 1980; Broad 1980; Stanley 1977; Goodman 1978; Joint Committee on 
Defense Production 1977:1:87-97; Office of Technology Assessment 1979; Ayres & 
Narkus-Kramer 1976; Krause 1981; Kihlstedt 1977; Lovins 1973]. 

tSome analysts [Boston Study Group 1979] believe that because of geography, 
there is no significant military threat to the territory of the United States 
that can be defended against: apart from minor incursions handled by the 
Coast Guard, the only overt external risk is from strategic nuclear attack, 
which cannot be defended against, although it may be deterred. (A modest 
Poseidon fleet would do this: each of the 31 Poseidon submarines has 16 mis- 
siles, each capable of carrying 10-14 MIRVs--a total of 160-224 independently 
targetable warheads per submarine, or about one for each of the 218 Soviet 
cities of over 100,000 population. Each warhead has a nominal yield of about 
40 kT--three Hiroshimas--and would kill roughly half the people in an area of 
the order of 15 square miles.) In this view, the United States itself could 
be adequately defended with some 3% of its present military budget, and the 
remainder is for general-purpose forces to defend U.S. allies and trade routes 
and to protect other U.S. interests abroad. Further pursuing such arguments, 
or the deterrence doctrine [Dyson 1981], is beyond the scope of this study. 
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the dangers of a protracted war of attrition against a country with relatively 
secure oil access [id.:23]. Indeed, this may underestimate the problem, since 
modern weapons require very highly refined fuels--a barrel of JP4 jet fuel 
needs about two barrels of crude oil [id.:25]--and present surge capacity and 
stockpiles are too limited for any but the briefest of wars. (DOD stockpiles 
in 1978 were about one month's peacetime use [Congressional Research Service 
1978:44].) The serious problem of guaranteeing fuels for today's military 
establishment [Moreland 1979] naturally lends a sense of urgency to military 
assessments of energy security. 

In recent years, however, it has become clear that these justified mili- 
tary concerns reflect in microcosm the role of energy in the vulnerability of 
the whole economy. "Of the most immediate concern" among "the main long-range 
trends that cculd threaten U.S. security," according to the 1978 DOD Annual 
Report [Brown 1978:26-27], is "the worldwide increase in the consumption of 
energy, and especially oil." The goal of mitigating that threat led to four 
"major objectives for U.S. energy policy" [id.]: providing “secure access to 
the energy necessary to maintain our standards of living and continue our eco- 
nomic growth," ensuring the same opportunities for our allies, avoiding exces- 
sive dependence on one type or source of energy, and keeping "the major sources 


" concluded the 


of energy from falling into unfriendly hands. These conditions,' 
Secretary, "are essential to U.S. security"--for only by meeting them "can we 
surmount the energy crisis. Only by surmounting the energy crisis can we 
retain the strength necessary to uphold U.S. security." But the stated objec- 
tives are to be pursued, not by increasing military strength, but by the famil- 
iar non-n itary means of national energy policy as a whole: expanding domestic 
reserves, aiversification, substitution, conservation, and stockpiling [id.] 
Further, a largely military approach to national security seems increas- 
ingly unresponsive to the interdependencies of a world in which the religious 
trends in Saudi Arabian society or the rate of decline of Romanian oil reserves 
can be as significant to U.S. oil supplies as Soviet expansionism. As General 


Maxwell D. Taylor [1976] remarked, 


Most Americans have been accustomed to regard national security as some- 
thing having to do with the military defense of the country against a 
military enemy, and this as a responsibility primarily of the armed forces 
....TO remove past ambiguities and recognize the widened spectrum of 
threats to our security, we should recognize that adequate protection in 
the future must embrace all important valuables, tangible or otherwise; in 


the form of assets, national interests, or sources of future strength.... 
An adequate national security policy must provide ample protection for the 


foregoing classes of valuables, wherever found, from dangers military and 


non-military, foreign and domestic, utilizing for the purpose all 
appropriate forms of national power. 


Likewise, Moreland and Bucknell ([1978:6] emphasize that 
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..-Mational security in its total sense is not simply a matter of defend- 
ing against external threats or becoming embroiled in wars abroad. The 
internal security of our country is properly a matter of national security 
concern. Because of the ubiquitous effects of energy supply and use in 
our society, it is apparent even now that major fuel shortages and a 
failure to undertake conservation and to develop alternative supplies in a 
timely manner could lead to severe conditions of depression, social 
unrest, violence, and political peril. Similarly, the threat of those 
dangers could cause us to undertake wars for which we are ill-prepared. 


In response to wider threats, a correspondingly broadened concept of prepared- 
ness has evolved [Joint Committee on Defense Production 1978:1:3-4]: 


At the close of World War II, the terms "preparedness" or "readiness" 
had an almost exclusively military connotation. To the extent that they 
applied to civilian activities, these terms related to prudent measures 
deemed necessary to protect the civilian populace against enemy attack or 
to assist in converting the civilian economy to a wartime footing. *** 

In the intervening decades, however, the term “preparedness” has come 
to have a much broader significance. It now includes not only measures 
aimed at securing the country's defenses and the protection of the popula- 
tion, but also a host of activities designed to prevent or mitigate the 
effects on persons and property of naturai disasters, resource crises and 
other economic disruptions, industrial and transportation accidents-~such 
as nuclear powerplant emergencies, spillage of flammable or corrosive 
chemicals, train derailments--and certain forms of terrorist activity. 

The growth in the significance of the word preparedness, although 
little remarked, has resulted primarily from...(1) the increasing vulnera- 
bility of a complex, highly interdependent industrial society, and (2) the 
increasing demands made on Government by citizens whose lives may be dra- 
matically affected by...emergencies they are unable to prevent or control. 
***(The "Murphy" Commission on the Organization of Government for the 
Conduct of Foreign Policy, June 1975, found]...an overemphasis on 

...security defined in narrow military terms as against 
broader security considerations and broader “economic”, 
"foreign policy", and "domestic" concerns. In fact, given 
most people s views about today's problems and the problems of 
the next decade, the structure of the 1940's is no longer 
appropriate. Even for security against physical threats to 
American life or property, armies no longer fully suffice. 
[Emphasis in original. ] 

Citizen concern for protection against a tornado, a nuclear power-plant 
meltdown, a flood, or a prolonged cessation of vital transportation 
reflects the commonsense understanding that the security of life and 
property is composed of more than defense against enemy invasion or 
coercion. This is not to underrate the significance of armies. It is 
rather to give full meaning to the idea of securing the general good of 
the populace. 




















Again, attacking historical but artificial distinctions (id. :34-35]: 


Among the most serious of receni trends is the tendency to make nuclear 
attack preparedness an entire’y separate and distinct function from peace- 
time emergency preparedness. This is of particular concern in view of the 
mounting evidence of increased social and economic vulnerability to non- 
military threats or disasters. A rigid distinction of this kind also 
contradicts the experience of most planners that the most important pre- 
paredness functions are non-specific as to type of disaster and that 
programs directed against the most common types of peacetime disasters 
provide an exceilent base for nuclear attack response. 
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This enlarged conception and operational structure of preparedness 
reflects a broad evolutionary view of its changing mission [Hermann 1977]. As 


Bucknell [1979:4-11] summarizes the task: 


ysseES AN ENERGY DEMAND 
TEA 
Safeguards KY ELEMENTS OF NATIONAL SECURITY 






























Threats 
Social and Economic Security Values disputed and cont!nuous!y Lack of Economic Security 
| through: given new oriorities under con- and Stability 
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». fagame Redistribution Constitutional Government subject 
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The demand for and the supply of Enersy affects al! of the Safeguards and 
Threats to the Elements of National Security. They, in turn, are affected 
by the supply and demand of eneray. 





An awareness of the broader energy vulnerabilities of our society, then, 
Suggests such national security objectives as: 

- Essential self-reliance and sustainability in vital resources, including 
energy. Since many of these resources are procured from developing countries, 
this implies attention to their continued willingness to sell those resources, 
hence to their economic and political stability and well-being. 

- Resource-distribution and -use systems capable of tolerating sudden, 
major decreases in supply of key resources, singly or in combination. 

- A flourishing, adaptive economy, free of "choke points" in which disrup- 
tions could have critical national impact [Joint Committee on Defense 
Production 1977:11:34]. 

- Domestic and international financial institutions designed to ensure 
integrity, promote stability, and deserve confidence. 

- Avoidance of large-scale public and occupational health and safety 


hazards arising from the energy system. 
- Protection of ecological variety and stability, with special attention 


to natural materials cycles, climate, and the basis of long-term biological 


productivity (e.g. in agriculture). 


- Domestic tranquility, based on social justice, pluralism, and shared 


respect for democratic values. BEST DOCUMENT AVAILABLE 
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The price of failing to achieve these objectives can readily be framed in 


economic terms, for example in the Undersecretary of State's concise account of 
interconnections within the non-military world oil problem [Cooper 1978:244]: 


If our nations do not prepare for the oil shortfall in the 1980's, the 
framework of international cooperation which we have worked so hard to 
build since World War LI will be imperiled. Severe economic disturbances 
would be followed in some countries by political instability. The trend 
toward freer international trade, which has been responsible for much of 
our post World War II prosperity, would surely be reversed under...reces- 
sion and oil-induced balance-of-payments difficulties. The prosperity and 
cohesion of the Western industrialized nations would be at stake, putting 
in jeopardy our own security and ultimately our way of life. 

The non-oil producing developing countries would also be hard hit eco- 
nomically. These nations are not profligate energy users; [they] use very 
little energy, but their economic development--both in industry and agri- 
culture--depends on the availability of imported energy. If oil prices 
are rising, the burden on the already fragile external financial condition 
of these countries would become insupportable. The cost of their imports 
would rise, and in world recession their exports will contract. Economic 
development would stop, if not regress. 


These conditions would breed international turmoil and foster revolutionary 
doctrines and political extremism. Speaking of the political fallout from 
inflation that occurred decades before oil prices started to drive it, Helmut 
Schmidt, while serving as F.R. Germany's Finance Minister, remarked: "I have 
only to go to the years 1931 to 1933 to say that the meaning of stability is 
not limited to prices." [Brown 1977a:33] 

Today in America, the inflation, unemployment, and frustration arising 
from further energy scarcity could endanger "an environment where competing 
values, needs and interests are resolved lawfully and not through resorts to 
violence" [Hoover 1979:1]. Simply having to wait in line to buy gasoline has 
led some Americans to shoot each other. With many other Americans already hav- 
ing to choose daily between heating and eating, and with safety margins of per- 
sonal survival rapidly shrinking, both hardship and anger would be bound to 
rise in more dramatic shortages. With them would rise interregional tensions 
and the problems of declining industrial regions--"[p]opulation out-migration, 
urban decay, declining local tax bases, and increasing social service costs.... 
Sharing social costs of energy-related unemployment, under-employment,...and so 
on...exacerbates longstanding and resistent differentials between racial and 
ethnic minorities...and the majority population." [id.:16-17] "The need for 
taking rapid and decisive action to reduce energy vulnerability, internal and 
external, directly clashes with the need for extended debate and compromise to 
resolve distribution of energy-related benefits, costs, hazards and deficits." 
[id.:20] Such stresses could lead to civil disorders or perhaps even to domes- 
tic terrorism. In this way too, the energy problem hazards our democratic 
practices, our most deeply held values, and our supreme national interests. 


These sources of domestic instability in turn pose military dangers, for 











"Deterrence is not...simply a matter of operational hardware. Potential 
antagonists mist also believe that the social and political fabric of the 
U.S. is sufficiently whole that this force would be employed if the coun- 
try were threatened by direct nuclear attack. Equally important is [the] 
perception that the U.S. is sufficiently stable that strategic nuclear 
forces will not be deployed in a first strike. It is certainly conceiv- 
able that the political and social stability of American society could be 
threatened by economic and social strains of energy scarcity to the point 
where the credibility of nuclear deterrence is lessened. However, most 
observers do not see increased vulnerability to direct military attack as © 
the most likely or urgent impact of energy scarcity on U.S. security. 
Secondary impacts of U.S. failure to deal with energy scarcity are mre 
important. Oil imports of a scale that would put other industrial 
economies at great risk [are]...an example. [Hoover 1979:2-3] 


The military and non-military threats which the energy problem poses to 
Our society are thus intricately interlinked and feed on each other. As Lester 
Brown's survey of emerging national security issues concludes [1977a:37-40]: 


The military threat to national security is only one of many that govern- 
ments mist now address. The numerous new threats derive directly or in- 
directly from the rapidly changing relationship between humanity and the 
earth's natural systems and resources. The unfolding stresses in this 
relationship initially manifest themselves as ecological stresses and 
resource scarcities. Later they translate into economic stresses--infla- 
tion, unemployment, capital scarcity, and monetary instability. Ultimate- 
ly, these economic stresses convert into social unrest and political 
instability.***Non-military threats to a nation’s security are mich less 
clearly defined than military ones. They are often the result of cumla- 
tive processes that ultimately lead to the collapse of biological systems 
or to the depletion of a country's oil reserves. These processes in them 
selves are seldom given mich thought until they pass a critical threshold 
and disaster strikes.***The purpose of national security deliberstions 
should not be to maximize military strength but to maximize national 
security.***The continuing focus...on military threats to security may not 
only exclude attention to the newer threats, but may also make [their]... 
effective address...more difficult [by diverting resources from them] .*** 
At some point governments will be forced either to realign priorities in a 
manner responsive to the new threats or to watch their national security 
deteriorate. 


This study deals with a specific class of threats to national security: 
those expressed through the energy system, and especially the kind of vulnera- 
bility described [Glassey & Craig 1978:330] as "the degree to which an energy 
supply and distribution system is unable to meet end-use demand as a result of 
an unanticipated event which disables components of the system. The kinds of 
events referred to are sudden shocks, rare, and of large magnitude." Later 
Chapters will develop this theme in detail. This section will first seek to 
put specific threats ("what can go wrong") and corresponding preparedness 
measures into context by briefly surveying all types of threats to the security 
of the United States. Chapters 2 and 3 will consider what these threats can do 


to energy systems and to specific energy technologies respectively. 


1.2. Foreseeable threats. 
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Identifiable and foreseeable threats to national security can range from 
matural disasters to aggressive physical acts (war, terrorism, sabotage) to ac- 
cidental or deliberate failures of complex technical and economic systems. Some 
have mainly a tangible or economic effect, others mainly psychological (as 
would be a threat to introduce a potent carcinogen into unspecified water 
supplies). Collectively, they offer a formidable array of hazards to life, 


liberty, the pursuit of happiness, and the preservation of democratic values. 
1.2.1. Natural disasters. 


Perhaps the most familiar threats with which preparedness deals are those 
commonly called “natural disasters"--though they may in fact be caused or ag- 
gravated by human activity. (For example, flooding can be caused by dam fail- 
ure or by building on a flood plain; unstable climatic conditions may be rela- 
ted to such stresses as carbon-dioxide and particulate emissions, deforesta- 
tion, and creation of urban “heat islands.") For some "natural disasters" that 
are sudden and catastrophic, like earthquakes, volcanic eruptions, and tsunamis 
(tidal waves), the areas at risk are broadly known but the times are not. Gene- 


ral precautions, though often inadequate [Los Angeles Times 1981], are commonly 





taken, such as reinforcement of buildings and upgrading of communications 
equipment for disaster-relief services. It may soon become possible--some 
authorities believe it is now possible--to give “suspicion” warnings of such 
disasters a few days in advance, though this capability raises thorny legal and 
political questions. Even if foreseen, these disasters might send shock waves 
through the economy: there is currently Federal concern, for example, that 
parts of the insurance industry may not survive the $80+-billion damage of an 
expected Richter 8+ earthquake in Los Angeles or San Francisco [Smith 1980]. 
Severe weather occurs frequentiy in a count ry as large as the United 
States. In 1973-75, an average of about three dozen major episodes per year 
caused damage totalling about a half-billion dollars per year [Joint Committee 
on Defense Production 1977:1:17-20]. Each region has a characteristic spectrum 
of such disasters: “hurricanes are especially likely...in Florida, droughts in 
Texas, tornadoes in Oklahoma, and blizzards in Wisconsin.” lid.:17] Other man- 
ifestations include windstorms, ice-storms, hailstorms, landslides, lightning, 
dust-storms, and floods. In 1960 storms which killed 354 people, ice deposits 
over 8" (20 cm) in diameter built up on wires [Stephens 1970:13]. Tornado 
winds can exceed 500 mph [id.:23]. Conditions as extreme as any in the world 


can occur in outwardly innocuous places: in New Hampshire's White Mountains, 


the officially recorded maximum windspeed is 231 miles per hour, and a tempera- 
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ture drop of sixty Fahrenheit degrees in forty minutes has been uncfficially 
observed in July. Few parts of the United States are essentially free of risk 
from extremes of weather, though the frequency of extremes varies widely. 

In many areas, “normal" bad weather is also disruptive, with routine snow- 
falls, spring thaws, ice breakups, etc. snarling transportation and communica- 
tion for days or weeks each year. This is also common in other countries: in 
the Soviet Union, for example, “seven out of ten...roads become impassable” 
during the autumn rains that left the German offensives of 1941 and 1942 bogged 
down in mud [id:I1:22] and during the spring thaw. This can become crucial in 
coping with non-weather emergencies. For example, civil defense planners have 
observed that severe winters and frozen ground make winter evacuation of Soviet 
cities “not feasible"; early summer evacuation would have to rely on depleted 
food stocks and would interfere with planting "so vital to the weak Soviet 
agricultural system"; and late summer evacuation would forego harvesting 
late-ripening crops (i.e. most except winter wheat) lid.]. At least some parts 
of the U.S. presumably have different but analogous evacuation constraints. 

Weather fluctuations can affect wide areas for periods of weeks, months, 
or (as in the Sahelian drought) years. In the U.S. in 1980-81, extreme cold in 
the Midwest and Northeast, and extreme heat in the South, caused as much dis- 
location as a major hurricane, but spread over a far longer period. There is a 
consensus in the climatological community that global weather patterns in the 
past decade or so have exhibited considerably greater fluctuations from the 
mean than earlier in this century and will probably continue to do so [Kirtland 
1981). Though fluctuations are commonly described on a seasonal basis ("this 
winter is much milder than last"), other time-scales are also important. The 
Colorado River Compact of 1927, for example, allocated water based on average 
flows for the previous decade, but subsequent average flows have been smaller 
by as much as a million acre-feet per year. The abnormality of the Compact's 
base years has been a fruitful source of litigation ever since [Glassey & Craig 
1978:335-6] 

Likewise, most of today's hybridized crops have been specially bred for 
best performance in climatic conditions which, though they seemed normal to 
plant breeders at the time, were in fact the mildest since the last Ice Age. 
Persistently more erratic and severe conditions, such as now seem to be emerg- 
ing, could severely test the ability of plant breeders to readapt--especially 


since the genetic base is being deliberately narrowed, and many adaptable, pri- 
mitive strains have already been lost [Myers 1981]. This linkage between agri- 


culture (or, more generally, stable biological productivity) and climate is es- 
pecially important because of the Likelihood that global climate is “almost- 


intransitive” [Lorenz 1976; Study of Man's Impact om Climate 1971]--that is, 
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subject to abrupt changes from one mode of behavior to another, brought about 
by very small, seemingly random causes but, once changed, relatively resistent 
to changing back again. This feature of many complex feedback systems is 
explored further in Chaprer 4. 

It is highly likely that we do not yet know all the potentially important 
triggers, comsequences, and interactions of environmental changes. Consider, 
for example, one narrow area of concern--the stability of regional and global 
climate. These are some of the unexpected energy/climate interactions whose 
existence was first widely revealed during the 1970s: 

- “Forcing” the nitrogen cycle by using synthetic nitrogen fertilizer 
increases the incidental production of nitrous oxide by denitrifying bacteria 
in the soil (especially if soil pH is reduced by acid rain). Some of the 
nitrous oxide diffuses up to the stratosphere, where its photochemical products 
attack the ozone layer, especially above 350 km, thus altering stratospheric 
Circulation patterns. Some analysts believe that near-term rates of artificial 
nitrogen fixation might be climatically significant [Isaksen 1980]. 

- Krypton-85 routinely released by nuclear reactors and reprocessing 
plants can apparently alter atmospheric ionization and hence the distribution 
of electric charge in the atmosphere (the fairweather potential gradient), with 
unknown but potentially large effects on nimbus rainfall and other processes 
important to global agriculture and heat transport. This may become important 
at concentrations orders of magnitude below those of radiological health con- 
cern, possibly including present or near-term levels [ Boeck et al. 1975]. 

- An oil spill in the Beaufort Sea, where drilling is now underway, could 
arguably spread under the fragile Arctic sea-ice, work its way to the surface 
with seasonal melting on top and freezing on the bottom, make the top of the 
ice gray in about ten vears, increase its solar absorptivity, and so lead to a 
probably irreversible melting of the sea-ice, with dramatic effects on hemi- 
spheric weather patterns [Campbell & Martin 1973]*. 

- Fluctuations in the behavior of charged particles in the upper atmos- 
phere over Antarctica have been correlated with power surges in the North 
American electrical grid--apparently coupled, and amplified by orders of 
magnitude, through some sort of resonance effect. The climatic relevance of 


this linkage, if any, is unknown [Park & Helliwell 1978]. 





These examples could as well have been taken from many other areas of 
earth science (or from biology or even political and social science) as from 
climatology. In sum, they represent a cornucopia of disagreeable surprises. 

When environmental conditions change, whether they be climatic, chemical, 
Or whatever, different organisms adapt at different rates and to different 


degrees. This can have consequences at least as serious as the change itself. 





*Present soot levels in Arctic air may also be of concern [Kerr 1981}. 
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Under the extreme stresses of a post-nuclear-war environment, for example, many 
insects are lLikelier to survive than higher organisms that eat them, because 
insects can tolerate several orders of magnitude more radiation [National Acad- 
emy of Sciences 1975]. Plagues of crop pests are a plausible result. Already, 
considerable outbreaks have been induced by similar differential selection 
under the much milder stress of biocide application. Seemingly trivial, highly 
localized environmental change can also cause awkward biological adaptations. 


For example, the young of the Asiatic clam Corbicula fluminea [Mieher 1980], 





too small to be stopped by screens, enthusiastically and prolifically adapt to 
the warmth, protection, and food-laden water flow in the artificial environment 
of freshwater-cooled steam condensers. Some power plants, pumping little but 


clams, have had to shut down twice daily to shovel them our. 


1.2.2. Deliberate actions. 


A second category of threats is those caused by human action, arising 
either outside the United States (wars, embargoes, interruptions of commerce) 
or domestically (sabotage, terrorism, etc.). If natural disasters happen to 
strike a point of weakness, that is an unfortunate coincidence; but malicious 
actions deliberately seek out and exploit vulnerabilities so as to maximize 


damage and constrain possible responses. Thus identifiable vulnerabilities can 


invite matching attacks. Identifiable threats meant to exploit those vulnera- 


bilities elicit responses to reduce them. These responses in turn are bound to 
have characteristic and perhaps different vulnerabilities--which asy be lesser 
Or greater than the original ones--inviting new forms of attack, and so on. 
This iterative, coevolutionary process reduces total vulnerability only if it 
carefully anticipates the new vulnerabilities created by responses to earlier 
ones. Otherwise, a France, seeking to reduce Mideast oil dependence, may 
become equally dependent on a nuclear-electric grid which (as subsequent 
sections will suggest) can be turned off even more easily than the oil. 
Vulnerabilities can be unexpected by both attacker and victim. The Iran- 
ian revolution's dramatic effect on world oil prices was probably as big a sur- 
prise to Iran as to oil importers. Vulnerabilities can be exploited accident- 
ally: [ran's bombing of Iraqi oil facilities was meant to hurt Iraq, not Italy, 
France, Brazil, and India. Surface vulnerabilities may be less important than 


deeper ones: a military attack meant to maximize immediate damage may do less 
Long-term harm than one meant to hamper recovery [Joint Committee on Defense 


Production 1977:11:37-38]. Modern, high-lethality nuclear warheads, for 
example, can encourage recovery-hampering attacks on such points of vulnerabil- 


itv as oil refineries in the United States [id.; infra] and certain Soviet in- 
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stallations crucial to agriculture. The latter include hydraulic facilities 
(dams, locks, pumping stations, canals) needed to irrigate or drain four mil- 
lion square miles of otherwise barren farmland, and factories making bulldozers 
and tractors (over 80% of the latter are made in nine factories) lid.:11:65- 
68]. Both countries appear to have highly vulnerable transportation sectors, 
but in different ways: the Soviets lack a higtly articulated network of rail, 
canal, and especially road routes, and each is already too overtaxed to take up 
much slack from the rest, whereas the U.S. has such a network (especially of 
roads) and of vehicles to run on them, but lacks a secure supply of fuel for 
those vehicles. (The Soviets shared that problem even in 1948-49, when a U.S. 
targeting plan for 150 nuclear weapons gave top priority to refineries, especi- 
ally those producing aviation fuel [Joint Chiefs of Staff 1949/78].) Subse- 
quent chapters will deal more fully with the vulnerabilities of energy systems 
to various disruptions, including enemy attack: not in any effort to duplicate 
the extensive analysis that has doubtless been devoted to targeting of energy 
facilities, but rather because vulnerabilities revealed in war often reflect 
others that may prove costly in domestic disruptions or natural disasters. 

Domestic sources of disturbance, besides sabotage, terrorism, and riots, 
may include strikes, lockouts, oligopolistic withholdings of supply, and judi- 
cial or regulatory restrictions (such as injunctions, permit suspensions or 
revocations, and declarations of pollution control emergency). Obviously, some 
of these may carry no intent to cause disruption, and may indeed be pursued 


with commendable ulterior motives. 
1.2.3. Mistakes. 


Many modern technical systems are liable to sudden, large-scale failure 
because they rely on elaborate design and construction techniques whose com 
plexity and technical adventurousness are conducive to serious mistakes. These 
technical failures are sometimes called “industrial accidents," but “accidents” 
are always caused by something--ignorance, carelessness, overconfidence, or a 
combination. Common sites of major failures include buildings, bridges, water 
or sewage plants, dams, locks, tunnels, aircraft, trains, or containments for 
toxic or hazardous substances. These failures may be manifested or accompanied 
by fires, explosions, physical collapses, leaks, spiils, etc., often in sequen- 
ces (derailments causing spills causing fires causing further releases) which 
greatly amplify the effects (as in the 2-4 kT 1946 Texas City fertilizer explo- 
sion [Stephens 1970:74]). Many technical failures could de prevented or miti- 


gated by the design precautions developed for energy systems in later chapters. 


Though technical failures are not the main focus of this study, they offer cau- 




















tionary tales. A NASA missile worth hundreds of millions of dollars had to be 
Slown up shortly after launch because a single sign error in a computer program 
put if on the wrong trajectory. (Analogously, had there been a nuclear war 
during a substantial period in the 1960s, all U.S. ICBM warheads would report- 
edly have missed their targets by a large and systematic marzin owing to an 
error in reentry calculations.) A radar image of the rising moon once caused a 
U.S. nuclear attack alert; when this was fixed, a flock of geese caused a new 
alert [Dumas 1976,1980]. There were 151 false attack alerts, four serious, in 
15 months [Coates 1980]. The great care applied to such matters is clearly not 
always enough: a fire incinerated three Apollo astronauts on 27 January 1967, 
and a Space Shuttle nitrogen purge error suffocated a worker on 19 March 1961, 
in extremely high-technology Launch-pad operations where the utmost precautions 
were presumably being taken. Some technical systems are simply sc complex as 


to exceed the Limits of attainable reliability and foresight (pp. 17£f£ infra). 
1.2.4. Command, control, and communications disruptions. 


Any system is by definition most vulnerable to disruption through its 
control mechanisms--those meant to affect its operation most by applying the 
least perturbation. The management structures and procedures for using these 
control systems, and the communications systems used to provide their input and 
convey their output, share in this enhanced vulnerability. As systems grow 
more complex, the volume and speed of information flow needed to control them 
grow to the point where only computers can cope with it. Computers’ undiscria- 
imating willingness to de what they are told, however nonsensical, increases 
control vulnerability by further concentrating in one place (albeit perhaps ac- 
cessible electronically from many other places) the ability to affect mich dy 
Little. For example, a Swedish Government assessment of "The Vulnerable Socie- 
ty" (Wentzel 1979:4] notes that the central computer of the National Social 
Insurance Board, in the northern town of Sundsvall, sends over 50 million pay- 
ments or financial messages per year (at a peak rate of half a million per day) 
to Sweden's eight million people. Computer failure "would affect Large nunbers 
of [people]..., chiefly those...with the least social and economic protection. 
(Non-military] threats to the computer...might include terrorism for political 
purposes, fire or water damage [or disruption by magnetic or electric fields or 
by reprogramming]. Even a lengthy power cut might have serious repercussions. 
Other critical situations might arise, for instance, from an industrial dispute 
involving personnel working with the computer.” lid. ] Small groups of systems 
analysts and programmers, even disgruntled individuals, can now constitute a 
national threat--which is why Swedish computer experts are being compartmentai- 


ized to “redistribute dependence among [more] people" [id.:7]. 











1s 
The Sundsvall computer's product is information, including instructions fo 
transact financial affairs. The product of energy systems, however, is deliv- 
ered electricity, oil, gas, etc. Their designers have tended to concentrate on 
ensuring the supply of that product, rather than on ensuring proper control of 


the information internally controlling that delivery. Most assessments of 





energy vulnerability, Likewise, deal with crude disruptions--o11 embargoes, 
pipeline or transmission-line sabotage, etc.--when in fact the greatest vulner- 
abilities may well lie in misuse of control systems. This subject is explored 
further, with specific examples, in the next two chapters. 

The first practical demonstration that the worst vulnerabilities may arise 
within control systems is today coming not from energy systems but from tele- 
phones. Highly intelligent and dedicated “phone phreaks” (or, as they prefer 
to be called, “communications hobbyists") are causing serivus loss of revenues 
for both public and private telecommunications companies im the U.S. An esti- 
mated 20% of the traffic on ARPANET is unauthorized. Some supposedly secure 
military communications links have been accidentally penetrated by experimen- 
ting students. The phone phreaks' ingenuity keeps them generally several steps 
ahead of security precautions. Using microcomputers, they can break codes and 
find passwords by automatic dialling. They collaborate pseudonymously via com 
puter teleconferencing networks and newsletters, some of which are specifically 
devoted to technical measures for fooling control systems into giving something 
for nothing (such as free phone calls, telex, water, electricity, gas, photo- 
copying, computer time, and cable TV). Some newsletters of “anti-system tech- 
nology” focus even more narrowly on ways to “crash” telephone and time-sharing 
computer systens--an occasional result of random intervention, but much easier 
to accomplish with understanding and purpose. It appears that one person, 
without compromising identity or location, can crash most or all of a corporate 
or commercial telephone network and keep it down more or less indefinitely, 
perhaps causing significant damage to electromechanical components in the 
process. Most, and with sufficient effort perhaps all, communications systems 
whose entry is controlled by electronic passwords rather than by phvsical 
barriers are vulnerable to penetration, misuse, and perhaps disruption. 

Physical barriers, of course, are not an absolute bar to phvsical penetra- 
tion by stealth or force. The physical vulnerability of some control svstems, 
like the control room of 4a nuclear reactor, may suggest a need for a remotely 
sited duplicate control room to be used if the first one is taken over (a pro- 
posal already rejected by the NRC, though some alternative control equipment 
for basic shutdown functions is provided). But such duplication also increases 


vulnerability to capture, or simply to interception and misuse of the communi- 


cations channels, as in computer and telephone networks today. False control 
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signals can then be combated by encoding, but this increases operational delays 
and errors: recall the 37 minutes it took for a technician to find the "ali 
clear” cape after accidentally broadcasting a tape announcing a Soviet nuclear 
attack [Dumas 1980:18f]. In this game of threat and countermeasure, problems 
simply cascade: the design principle seems to be “One dammed thing leads to 
another” (a theorem familiar to nuclear designers who find many accidents 
arising from safety systems’ failing or interfering with each other). To the 
extent that deliberate intervention in a control system car be combated, it is 
seldom bv adding vet more layers of complexity, but by a quite different 
strategy of resilient design (Chapter 4). 

The vulnerability of controls is especially marked in computerized finan- 
cial systems. An adversary could probably crash the U.S. (and international) 
banking system simply by using electronic funds transfer (EFT) to make many 
billions of dollars vanish instantaneously. In 1980, four l3-year-olds brought 
chaos to some Ottawa commercial computers while playing with a microcomputer at 
their New York private school [Friedman 1980]. Fraud, sabotage, and coercion 
using EFT has already reached alarming (if largely unpublicized) proportions. 
If a computerized embezzlement is detected (many cannot be), that fact itself 
is frequently an effective lever for blackmail, lest the victimized organiza- 
tion lose public confidence or have to pay higher insurance premia. It is 
doubtless encouraging to potential computerized thieves that of the few caught 


so far, most have been rewarded with lucrative jobs as security consultants. 


1.3. The chain can be more vulnerable than its weakest link. 





The foregoing survey of threats to national security--brief and far from 
comprehensive--is altogether too sanguine, for it has not yet related potential 
disruptions to the complex interdependencies of the systems in which they act. 
As a pioneering study of vulnerability [Dresch & Ellis 1966:3] declared: 


This study is concerned with total vulnerability, or more precisely with 
the vulnerability of the totality--the whole nation as a social system. It 
is thus concerned with developing a methodology for assessing the chances 
of this system surviving without drastic or significant change in its 
essential characteristics, without fatal impairment of its capacity for 
regenerating damaged parts or subsystems, and without sustaining stres-~- 
ses, tensions, or flaws fatal to its normal evolution and its normal 
processes for adjusting to environmental change. *** 

It is conceivable that components or subsystems could be identified that 
are vulnerable to attack and that their loss would destroy the nation in 
some important sense. It also is conceivable that other components might 
be highly vulnerable, but that the system has the clear capacity to 
restore those components or to get along without them. The assessment of 
vulnerability, therefore, cannot rest on a mechanical collection of 
assessments of the vulnerability of separate parts. |Emphasis sdded. | 

















“Mechanical collection," however, is what most vulnerability studies do. at 
Dest, they assess energy vulnerability (for example) by concatenating the indi- 
vidual vulnerabilities of fuel sources, processing plants, storage and trans- 
mission and distribution facilities, etc. But this reductionism ignores the 
crux of the problem: interactions, combinations, feedback loops, higher-order 
consequences, and links across the system boundary. The complexity of these 


links may defy analysis, though not anecdotal illustration. 
1.3.1. Common-mode failures. 


Any system, for example, is subject to “common-mode” failure (p. 146n), as 
when several supposedly independent valves all fail for the same reason--perhaps 
dDecause of a common design flaw or because they are all exposed to conditions in 
which they cannot survive or because they all suffer a power failure. Common- 
mode failures cannot be identified simply by cataloguing individual failure 
modes or probabilities. In a spectacular example, the afterheat removal system 
in the Oak Ridge Research Reactor failed for several hours during operation on 
19 November 1969 even though it had three identical channels backing each other 
up [Epler 1970]. In each channel, there were three separate operator errors, 
two equipment installation errors, and three design errors (one of which did not 
affect the outcome because the circuit in which it occurred was inoperable for 
other reasons). The system would have worked if any one of these 21 failures 
(seven identical errors or equipment failures in each of three channels) had not 
occurred. "This is almost unbelievable, especially in view of the importance 
that is attached to the single-failure criterion wherein no single failure shall 
prevent proper [operation]....***lt must be concluded that present tools and 
methods are ineffective in uncovering the source of common mode failure....[Rle- 
Liability analysis would have uncovered nothing. The single-failure analysis 
would also have been ineffective." [id.] Damage to the core was prevented only 
Decause a less reliable backup system, which the failed ones had replaced, 
happened still to be available and functioning. 

The causes of other common-mode suclear safety failures are legion. In one 
memorable case, a technician adjusting the trip points in several supposedly 
independent safety channels happened to calibrate them all to an inoperable 
range simply Dy setting his voltmeter selector switch on the wrong decade 
position. In another case, a key circuit failed because a test procedure simi- 
taneously destroyed a diode and confirmed that it was in good order. A popular 
sampler anthologized from official reports of such incidents [Pollard 1979] 


netes common-mode failures from such diverse sources as power-supply outage 


[id.:17], disabling of four power sources when a failed transformer hurled 
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a lead across a 69-kV bus [:28], incorrect installation [:30] or manufacture 
{:70,70,73], cold solder joints [:48,65], floats that leaked, filled up, and 
sank [:50], wiring errors copied onto wiring diagrams [:51], water damage from 
outside component storage [:57], contaminated lubricating oil [:61], clogged 
pump inlet strainers [:62], pipes frozen by the failure of a miswired heater 
thermostat [:63], and unknown causes [:11]. In one instance, control rods 
moved out when commanded to move either in or out [:17] because the two-phase, 
three-wire drive motor, after one wire became disconnected, could start up on 
the remaining phase--supposedly an impossibility--owing to an interaction with 
the windings of a cooling-blower motor wired in parallel with the drive motor. 
In another case [:22], relays designed to be fail-safe, opening if their power 
failed, stuck shut because of sticky paint: similar relays had proven highly 
reliable for 30 years, but new staff at the manufacturer's new plant had put 


the paint on thicker. 
1.3.2. Unpredictable interactions. 


The sheer complexity of many technical systems can defeat efforts to pre- 
dict their failure modes. "The sequence of human and mechanical events leading 
to the two most serious power reactor failures in the U.S. [at Browns Ferry 
and Three Mile Island] were excluded from fault tree anaiysis in the most com 
prehensive study of reactor safety ever undertaken [Rasmussen et al., NRC 1975]. 
Clearly it is possible to construct systems sufficiently complex that all prob- 
able states of the system are not foreseeable." [Hoover 1979:53] A 29-cent 
switch burned out by improper testing caused grotesque failures to cascade 
throughout the Apollo 13 spacecraft [Cooper 1973]. In 1980, as simple an ini- 
tiating event as dropping a wrench socket down an Arkansas missile silo led to 
the explosive ejection of a megaton-range Titan warhead into a nearby field. 

The complexity of even the most advanced technical systems, however, is 
dwarfed by that of biological and social systems, as a simple example illus- 
trates [Holling & Goldberg 1971:222]. The World Health Organization attacked 
malaria-carrying mosquitos among the inland Dayak people of Borneo with verve 
and abundant DDT. The people became much healthier, but their roofs started 
falling down. The DDT had killed a parasitic wasp which had previously con- 
trolled thatch-eating caterpillars. Worse, the cats then started to die: they 


had built up lethal doses of DDT by eating geckos which had eaten poisoned 
caterpillars. Without the cats, rats flourished. Faced with svlvatic plague, 


the WHO had to parachute cats into Borneo. "We cite this example," the authors 


remark, “not because it has great substance, but...because it shows the variety 


of interactive pathways that link parts of an ecological system, pathwavs... 
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{so] intricate...that manipulating one fragment causes a reverberation 
throughour...." [id.] 

A further example (id. :223] extends the concept. Farmers in the Canete 
Valley on the coast of Peru shifted in the 1920s from sugar cane to cotton. 
This developed an economically tolerable infestation by seven native insect 
pests. In 1949, persistent, highly toxic, broad-spectrum pesticides, such as 
DDT and toxaphene, because cheaply available for distribution by aircraft 
throughout the confined valley, offering an opportunity to decrease crop damage 
dramatically and hence increase yields and profits. That initial result was 
followed within a few years, however, by the emergence of six new cotton pests 
that had not previously been a problem; then, six years later, by the return of 
the original seven pests, now equipped with pesticide resistance. Despite 
heavier and more frequent spraying and the use of organophosphorus insecti- 
cides, “the cotton yield plummeted to well below yields experienced before the 
synthetic pesticide period. The average yield in 1956 was the lowest in more 
than a decade, and the costs of control were the highest." The near-bankrupt 
farmers were forced into a sophisticated program of integrated pest management 
based on reformed farming practices, minimal use of biocides, and fostering of 
beneficial insects. As any ecologist might predict, once biological balance 
was restored, pest levels dwindled and yields increased to the highest levels 
in the valley's history. This is, however, a story of luck. The farmers might 
well have caused irreversible damage: their effort to achieve a narrowly 
defined objective (eliminating seven insect pests) in the cheapest and simplest 
way had generated "a series of unexpected and disastrous consequences explicit- 
ly because of the narrow definition of the objective and the intervention." 

The Borneo and Canete examples, Holling and Goldberg note (id.:224], "il- 
lustrate four essential properties of ecological [or other complex] systems”: 


By encompassing many components with complex feedback interactions between 
them, they exhibit a systems property. By responding not just to present 
events but to past ones as well, they show an historical quality. By re- 
sponding to events at more than one point in space, they show a spatial 
interlocking property, and through the appearance of lags, thresholds, and 
limits they present distinctive non-linear structural properties....[E]co- 
systems are characterized not only by their parts but also by the interac- 
tion among these parts. It is because of the complexity of the interac- 
tions that it is so dangerous to take a fragmented view, to look at an 
isolated piece of the system. By concentrating on one fragment and trying 
to optimize the performance of that fragment, we find that the rest of the 


system responds in unexpected ways. 














By applying these biological insights (Chapter 4) to urban renewal, rent con- 
trol, and freeway construction, Holling and Goldberg (id. :227228] were even 
able to predict and explain results that had long baffled analysts of urban 


socioeconomics. 








These properties of natural and social systems--properties derived from 
their very complexity--are precisely those that are critical, as Brown [1977a] 
argued above, to the conceptual basis of effective preparedness. Viewing 
security as solely an outgrowth of military strength (whose impact is as narrow 
and double-edged as that of the Cafiete Valley pesticides) dangerously neglects 
the effect of economic, ecological, and social disturbances on the very systems 
one is seeking to secure. Focusing on one aspect of security at a time ignores 
the interactions among all aspects. Subtle, higher-order interactions can be a 
greater threat than direct, first-order consequences. 

Where cause-effect relationships are too complex to understand intuitive- 
ly, attempted solutions can make the national security problem, or other prob- 


lems, worse: the cause of problems is often prior solutions. Some systems 





analysts, such as the mathematician Roberto Vacca [1974], believe that poorly 
understood interactions may prove collectively so unmanageable as to lead to 
the breakdown of industrial society. The Swedish vulnerability study [Wentzel 
1979:2], citing this view, found "similar apprehensions among technicians, 
biologists and sociologists." Perhaps an extended qualitative illustration 
(Lovins 1977b:10-11] can convey the flavor of these unexpected interactions, 
feedback loops, and potential instabilities in modern techno-economic systems 
and how they bear on energy preparedness. The following example is of course 


highly selective, but is not a wholly tongue-in-cheek description of mcent trenis. 


1.3.3. Tracing higher-order consequences. 


The United States pursued for many years a policy of promoting the use of 
more energy while holding its price down through regulation and subsidy. Be- 
Cause the energy looked cheap, its users did not know how much was enough, and 
grossly underinvested in energy productivity. The resulting emergence of the 
‘nited States as a massive net importer in the world oil market harmed many 
U.S. allies. It harmed the economies of some oil-exporting countries which 
were being asked to lift oil at a rate detrimental to their reservoirs or eco- 
nomies or both. It devastated the Third World, which was unable to compete for 
the oil. The value of the dollar fell. Dollar-denominated oil prices rose. 
The U.S. then needed even more foreign exchange to pay for the oil. It earned 
this in three main wavs: depleting domestic stocks of commodities (which was 
inflationary, left the forests looking moth-eaten, and left holes in the ground 
where orebodies used to be); exporting weapons (which was inflationary, destab- 
ilizing, and of controversial morality); and exporting wheat and soybeans 


(which inverted Midwestern real-estate markets and probably raised domestic 


food prices). Exported American wheat, until embargoed, diverted Soviet 
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capital from agriculture to military activities, increasing pressure on the 
U.S. to raise its own [inflationary] defense budget--which it had to do anyhow 
to defend the sea-lanes to bring in the oil and to defend the Israelis from the 
arms sold to the oil-exporting Arabs. (From this point of view, the best form 
of Middle Eastern arms control might be American roof insulation.) 

With crop exports crucial to the balance of payments, pressure mounted for 
even more capital-, energy-, and water-intensive agribusiness. Fencerow-to- 
fencerow planting and cultivation of steep and marginal land raised soil-loss 
rates to levels exceeding to those of the Dust Bowl, with a dumptruck-load of 
topsoil passing New Orleans in the Mississippi River each second--not counting 
soil that was compacted, burned out, or sterilized. Heavy chemical inputs and 
a severely narrowed genetic base impaired free natural life-support systems. 
Still more oil was needed for fertilizers, pesticides, herbicides, irrigation, 
and desalination. All of these increased the stress on remaining natural 
systems and threatened uncontrollable epidemics of crop pests with an evolved 
resistance to chemical pesticides. More energy was needed to pump the vanish- 
ing groundwater from greater depths and to purify drinking-water contaminated 
with nitrate runoff. More coal strip-mines and power plants, using still more 
water and land, were needed to supply the energy. The capital intensity of 
modern agribusiness, coupled with fluctuations in markets and weather, became 
unsustainable in the 1980 recession when land values (on whose inflation 
farmers had borrowed heavily to pay their carrying charges) stopped inflating, 
instantly creating thousands of mini-Chrysiers out of Midwestern farms. 

The spiral sped faster as artificial financial incentives demanded quicker 
returns. The Ogallala Aquifer under the High Plains was drawn down one to 
three meters per year and recharged less than a centimeter per year. It was 
already half gone when the lifting rate, during the four dry months of the 
year, surpassed the full annual flow of the Colorado River past Lee's Ferry. 
Two-fifths of America's feedlot cattle came to be grown on grains made of 
Ogallala groundwater. Growing enough of that grain to put enough weight on a 
feedlot steer to put an extra one pound of meat on the table came to consume 
about a hundred pounds of lost, eroded topsoil and over eight thousand pounds 
of mined, unrecharged groundwater [Jackson 1980; Jackson & Bender 1981]. To 
replace imported oil, some people started to make the corn into ethanol fuel, 
but because of the unsustainable farming practices, each bushel of corn 


consumed about two bushels of topsoil [id.]. 
Meanwhile, excessive substitution of apparently cheap inanimate labor 


exacerbated structural unemployment. A tax system left over from an era of 
plentiful capital and scarce labor, and therefore designed to subsidize capital 


investment and tax *mployment, also increased unemployment. This worsened 








poverty and inequity, which increased alienation and crime. High oil prices 
and the collapse of the automobile industry hastened the decay of the urban 
Northeast. Priorities in crime control and health care were stalled in part by 
the heavy capital demands of building and subsidizing the energy sector, which 
itself--by its extraordinary capital-intensity and its noxious emissions--con- 
tributed to the unemployment and illness at which those investments were aimed. 
Energy prices and oil balance-of-payments deficits helped to drive inflation. 
Inflation and unemployment fed civil unrest. The growing vulnerability of the 
energy system to strikes, sabotage, and protest required greater guarding, sur- 
veillance, and erosion of civil liberties. These encouraged the beginnings of 
a drift towards a garrison state. This drift, coupled with consolidation of 
oil and uranium cartels and a widespread failure to address the energy security 
needs of developing countries hit hardest by oil prices, encouraged interna- 
tional distrust and domestic dissent, feeding further suspicion and repression. 
On the horizon loomed energy-related climatic shifts that could jeopardize ag- 
riculture, especially in the Midwestern breadbasket, so endangering a hungry 
globe. The competitive export of arms, reactors, and inflation from rich to 
poor countries made the world more inequitable, tense, and anarchic. Plans 
proceeded to create, within a few decades, an annual flow of tens of thousands 
of bombs’ worth of plutonium as an item of commerce within the same interna- 
tional community that had never been able to stop the heroin traffic. Nuclear 
bomb capabilities crept towards the Persian Gulf from several directions. 

All this is rather a lot, of course, to blame on underpriced energy. But 
the point of this informal, slightly whimsical tracing of some possible conse- 
quences is that the elements of national security must be considered as an 


interdependent whole. Their bizarrely intricate connections keep on working 





whether we perceive them or not. 


1.4. Surprises. 





We do not yet have, and may not have for a very long time if ever, all the 
information we need to foresee all important consequences of our actions. 
This does not mean that we dare not do anything. It does mean that we need to 
view any reductionist catalogue of national security concerns with a certain 
wariness and humility, knowing that it cannot capture the range of surprises 
from without, or the higher-order interactions within, that together almost 
certainly dominate total risk. 

In 1974, one of us (ABL) made a list of the twenty most likely surprises 


in energy policy over the next decade or two. Near the top of the list were "a 


major reactor accident" and "a revolution in Iran.’ 





Number twenty on the list, of 
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which no examples could be given, was "surprises we haven't thought of yet." 
There will be many of those, not only because there is so much still unknown 
about how the world works, but because rare events do happen. A principle 
enunciated by George Orwell and E. B. White, and known to discomfited experi- 
mental scientists as the Totalitarian Law of Physics, states that "Whatever is 
not forbidden [by the laws of physics] is compulsory"--it will happen sooner or 
later. There are many possible events which may be individually very rare: 
their probability may be vanishingly small. But these surprises are also 
almost infinitely numerous, so they will catch up with us, and one or another 
of them is likely to occur fairly frequently. We live in a world full of nasty 
surprises, and had better prepare for it. 

National security, therefore, requires not only that we calculate the 
probability of foreseeable kinds of failure, but also that our designs include 
the broader philosophy of resilience in the face of the incalculable: lunatics, 
guerrillas, Middle East wars, freak winters, social turmoil, unpredicted high- 
technology failures. True preparedness requires not merely an explicit 
readiness for foreseeable threats--the subject of the next two chapters--but 
also an implicit readiness for unforeseeable and imponderable threats. The 
theme of unforeseeable threats to complex, interactive systems, and the design 
Principles for resilience that flow from the inevitability of such threats, 


will return for full development starting in Chapter 4. 











2. GENERAL VULNERABILITIES OF THE U.S. ENERGY SYSTEM 





2.1. What makes the energy system vulnerable? 





Most commercial fuels and power in the United States today are delivered 
Dy processing and upgrading fossil fuels in relatively remote, centralized 
plants, then distributing the concentrated, high-quality product via elaborate 
transmission networks to dispersed users. These processes depend on massive, 
highly capital-intensive, long-lead-time facilities of high technical and 
social complexity, operating continuously under precise controls. 

The familiarity and usual dependability of this system encourage a belief 
that it will continue to resist disruption in the future. But the purpose of 
vulnerability analysis is to ensure preparedness, not necessarily to defend the 
Status quo. In fact, as we shall show, the very properties of the modern 
energy system that make it such a visible and impressive technical achievement 
also make it peculiarly vulnerable to the threats described in the previous 
Chapter. Each property just listed contributes to this latent vulnerability in 
ways we shall now describe under the following topics: dangerous materials, 
limited public acceptance, centralization of supplies, large haul lengths, 
limited substitutability, unique characteristics of grid electricity, inflexi- 
bility of delivery systems, high capital intensity, long lead times, special- 
ized labor requirements, control problems, and possible adaptability of fuel 
delivery systems to delivering other substances instead. Chapter 3 will apply 
this generic discussion to some specific energy technologies; first, selected 


examples will illuminate the structural properties of the energy system. 


2.1.1. Dangerous materials. 


Many of the forms in which energy is commonly delivered are hazardous in 
their own right. Though accidental electrocution is uncommon, defective eiec- 
tric wiring is among the leading causes of fires (with poorly installed and 
maintained wood stoves gaining on it fast). But the main danger arises from 
the deliberately high energy density of fuels--the energy carriers which, by 
direct combustion, supply 87% of U.S. delivered energy. A gallon of average 
gasoline, for example, contains as much energy as a strong horse produces in 49 
hours’ work. A standard gasoline pump (say 50 liters per minute) delivers fuel 
energy at the remarkable rate of 29 thermal megawatts; thus a 20-pump station, 
when all its pumps are working, is delivering energy about as fast as a 500-MWe 


power station [Foley 1979]. 
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Such fuels are, by intent, highly flammable or explosive. The amounts of 
fuels present even in their most dispersed stages of distribution, such as tank 
trucks, are sizable hazards. A 9000-gallon tank truck of #2 fuel oil contains 
the energy equivalent of a small (0.3 kI) nuclear explosion (although if it 
burned, the energy would appear not as prompt radiation or blast but as radiant 
heat sufficient to melt nearby cars). In refinery accidents, burning 011 flows 
have covered as much as 17 hectares--an essentially unmextinguishable conflagra- 
tion--and vapor explosions have devastated as mich as 12 hectares [Stephens 
1970:69,96]. The hazard is not limited to petroleum-derived fuels: at least 
one worker was killed in the 6 March 1981 explosion of a 680-m> ethanol 
tank in Sao Paulo, Brazil [Los Angeles Times 19815]. 





Gaseous fuels, being harder to contain, increase the hazard: "With vast 
quantities of a highly explosive substance [natural gas] being carried at very 
high pressures in a steel pipeline with a wall thickness ranging from 1/10" to 
1/2", often near or through populated areas, the potential for catastrophe is 
considerable." [Congressional Research Service 1977:1:13] "A gas pipeline can 
be bombed over a considerable length by a single charge. [t will blow up by 
itself if a break allows air into the line. An air-gas mixture, under [the] 
right conditions, can explode and detonate over miles of terrain, through 
cities and industrial centers....The writer observed an 8-inch spiral weld line 
that unwound and came out of its ditch for a distance of 8 miles. A larger 
line would result in a worse situation. Detonation can occur even in a 2-inch 
line." [Stephens 1973:34-35] Compared to, say, piped water, this is an im 
pressive potential for mischief, demanding meticulous care. Such energy densi- 
ty increases the likelihood of serious consequences from an initial disruption, 
whether from naturai disaster, deliberate attack, or technical failure. The 
ready availability of such materials as natural gas, propane, and gasoline also 
expands the destructive capability of terrorists by making it relatively simple 
for them to improvise fuel-air explosives whose detonation inside major, 
heavily reinforced structures can demolish them. 

Another manifestation of high energy density is the radioactivity of 
nuclear materials. Pure fissionable materials have over a million times the 
energy per unit volume of pure hydrocarbon fuels. They are mildly radioactive; 
many of their fission and activation products, intensely so. Despite extensive 
precautions, the possibility remains of accidental or deliberate releases; and 


since the threat is insensible and can have long-term consequences with high 


emotional impact, even the possibility of a minor release can have major social 


effects. "More than any other type of peacetime disaster,...nuclear emergen- 


cies could cause mass panic....{T]he prime danger comes...from the [wide] dis- 











persal of radioactive material..., impossible to detect without special instru- 
ments, [and which] could cause fearsome and unpredictable consequences: cancer, 
sterility, and gross birth defects...for many years after...release." [Joint 
Committee on Defense Production 1977:1:29] Since many of these effects are 
indistinguishable (even statistically) from those arising from other causes, 
the perpetrators of a release can be blamed for far more harm than they did; 
conversely, people cannot be sure the release was not the cause of their af- 
fliction, and actual victims may be unable to prove causality as a basis for 
just compensation. These perplexing issues, now being raised in class actions 
dv persons exposed to the Three Mile Island releases and to fallout from 
military nuclear weapons tests in the 1950s, have aroused considerable public 


attention and anxiety. 


2.1.2. Limited public acceptance. 


Such anxiety is only one of many sources of broadly based, ideologically 
diverse reluctance to bear the social costs of major energy facilities. The 
sources of opposition include a desire to preserve a particular way of life 
(an important issue in rural Western areas threatened with boom-town develop- 
ment); concern about a wide range of environmental impacts (water use, loss of 
habitat or endangered species, biomedical effects of electric fields from high- 
voltage transmission lines, safety of LNG or nuclear plants, oil pollution, 
nuclear proliferation, noise, coal dust, heat releases, esthetics, etc.); 
desire to defend certain social structures or values (free enterprise, small 
business, local self-reliance, etc.); or even perceived vulnerability itself. 

It does not matter here how far these diverse concerns are justified or how 
widely they are shared; the important thing is that they represent views sin- 
cerely and strongly held by citizens of a democracy who believe they are 
entitled to give their views political and practical effect. Many historical 
examples suggest [Lovins 1979,1980a] that efforts to bypass or suppress such 
concerns bear high political costs and often turn out in hindsight to represent 
a refusal to listen to advance warnings of serious errors in policy. For 
present purposes, however, it is sufficient to note that major energy facili- 
ties of any kind--like highways, water projects, chemical factories, toxic- 
waste dumps, eftc.--can come to represent to many people a highly visible focus 
for both project-specific and broader grievances. By threatening direct and 
undesired impacts, by embodying social diseconomies of scale (Chapter 5), or by 
symbolizing other perceived inequities, such a facility can be, from the stand- 


point of civil disturbances, an attractive nuisance*. Nuclear facilities, 





*And can have troublesome civil-liberties implications (see references, p. 62). 


besides their technical vulnerability (Chapter 3), are clearly among the mst 
prominent Lightning-rods for such social tensions [Foley & LYnnroch 1981:25]: 
hence several studies, e.g. by Bass et al. [1980], on the porential for crimin- 


al acts against nuclear power programs motivated partly by opposition to them. 


2.1.3. Centralization of supplies. 


The geographic separation of primary energy sources (oil and gas fields, 
coal mines, dams, etc.) or of conversion facilities (refineries, power plants, 
etc.) from final users has two obvious physical results: it concentrates the 
facilities themselves into a small area, more vulnerable to all sorts of dis- 
ruptions, and it makes the connecting Links longer and hence more tenuous (as 
quantified below). But a more subtle social result of this separation may be 
equally important: the automatic allocation of the delivered energy and of its 


side-effects or social costs to different groups of people at opposite ends of 





the transmission lines, pipelines, and rail lines. This divorce of costs and 
benefits is considered admirable at one end but, often, unjust at the other. 
To put it baldly, politically weak rural people do not want to live in “zones 
of national sacrifice” for the benefit of “slurbians"” a thousand miles away. 
Further, the very scale and complexity of most modern energy projects 
tends to organize their planners and builders into particular patterns which 
may be, or at least appear to be, remote and unresponsive to local needs. These 
trends have together led in the United States to mre than sixty “energy wars” 
--violent or near-violent siting conflicts--now in progress. They reflect an 
intensity and breadth of social unrest that any student of energy vulnerabili- 
ties mist take seriously. Archetypical, perhaps, is the long-running rebellion 
(Casper & Wellstone 1981] by politically conservative farmers in northern Min- 
nesota who nightly dismantle high-voltage power lines that have been built dia- 
zonally across their land through a political process that they consider unjust 
and illegitimate. An anthropologist who has named, analyzed, and often succes- 
sfully predicted the course of this and other “energy wars" [Gerlach 1979; 
Gerlach & Radcliffe 1979] persuasively argues that they often reflect an under- 
lying conflict between a network and a hierarchy; the network generally wins. 
Additional social feedba-k loops can further heighten the risk that social 
unvest will spill over into deliberate disruption of energy systems. For exam 
ple, the economic insecurity or inequity that massive energy projects may bring 
to both ends of their distribution systems tends to increase tension and con- 
flict. The perceived risk and social unattractiveness of the projects and the 


difficulty of siting and guarding large numbers of plants may in turn heighten 





pressures for further centralization in remote, paramilitarized enclaves like 
“nuclear parks" [Burwell et al. 1979; Nuclear Regulatory Commission 1976b], 
built perhaps on the energy scale of the Mideast oilfields [IIASA 1981]--the 


same scale whose vulnerability had been the rationale for nuclear power. 
2.1.4. Long haul distances. 


Most energy sources in the United States have become far more centralized 
than their customers. The distribution distances required by this disparity 
can be roughly quantified. For example, a 1-GWe (1000-MWe) power station 
occupying a site of about 10 sq km, including the area of its coai depot or 
nuclear exclusion zone, represents a source whose power density (1 kWe/m2) 
is four to five orders of magnitude (factors of ten) greater than the average 
density of electricity consumption [Baughman & Bottarc 1976; p.167]. That aver- 
age density use corresponds to an average service radius, for a 1-GWe plant, of 
about 150 km (90 miles). In fact, for a marginal plant of about | GWe capaci- 
ty, the actual average haul length is about 350 km (220 miles) in the United 
States, or about 100 km (60 miles) in the denser grids of Western Europe. Some 
electricity travels a far greater distance: British Columbia hydroelectricity 
goes as far as Southern California and Arizona, and some Churchill Falls 
(eastern Canadian) hydroelectricity probably gets nearly to Florida. 

The average barrel of oil Lifted in the U.S. is transported a total of 
about 965-1290 km (600-800 miles) before final use [Energy & Defense Project 
1980:11]. The average unit of natural gas probably moves even further. In 
1974, 66% of U.S.-mined coal was hauled an average of 485 km (300 miles) by 
rail, and 21%--especially in the Ohio River Valley--an average of 775 km (480 
miles) by barge (Congressional Research Service 1977:1:62-63,77]. Remote West- 
ern strip-mining and exploitation of Arctic and offshore petroleum resources 
will considerably increase the average haul lengths. "The average distance we 
have moved our energy sources has continuously increased..., and all signs 
point to an even greater extension of these vital supply lines." lid. ',2) 
Longest of all--halfway around the world--are the supply lines for Mideast oil. 

These long haul lengths increase vulnerability to all the types of hazards 
noted in Chapter 1. Different fuel delivery systems, of course, have different 
vulnerabilities. "The pipeline network [in California] contains fewer parallel 
Links than the highway net, and has less excess capacity for carrying fuel. 
Therefore, it is more vulnerable to disruption by earthquake. However, it is 
less vulnerable to a Teamsters’ Union strike." (Glassey & Craig 1978:330-331) 

Historically, the greatest concern about fuel and power transportation has 


been that, being outdoors and over long distances, "A large portion of the fuel 
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movement...in the United States is vulnerable to disruption from inclement 
weather, and all forms of fuel shipment are subject to disruption by natural 


disaster." [Congressional Research Service 1977:III:189] In the cold winter 


976-77, for example, “The Ohio River froze bank to bank|,] blocking barge 


OG 
vy 
- 


traffic in both fuel oil and coal. Coal [werted ar the mine face to suppress 


dust] froze solidly in rail cars, sometimes requiring blasting to remove it. 


winter snows impeded truck movements of heating oils, gasoline, and LPC.” Lid. 


189] The seriousness of such effects depends on the mix and flexibility of 


fuel use in the area. For example, the Ohio River's freeze was especially dis- 


ruptive because the regional dependence on coal that made the 109-cay 1978 


miners’ strike [Ackermann 1979] so disruptive in the Midwest [Subcommittee on 


Energy & Power 1978:17] coincided with a regional dependence of coal movements 


on barges. “Water carriers are, by and large,...most subject to weather...-- 
freezing, flooding, and drought [which reduces allowable draft and constrains 
navigable channels] can all have very disruptive impacts." [Congressional 
Research Service 1977:II1I:191] 


Slight differences in the nature of the disruption can greatly change its 


consequences: the winter of 1977-78, though nearly as cold as 1976-77, caused 
virtually none of its dislocations in fuel delivery [Kellogg & Schware 1981: 
63], both because the local details of interference with shipments differed 


and because people were better prepared the second time. But a great variety 


of circumstances is available to test the energy system for potential weakness- 


es. For example [Quirk & Moriarty 1980:90-91): 


- The 1976-77 heating season had 22% more degree-days (a measure of space- 


heating requirements) and was an average of 1.8°C colder than 1975-76; the 
1976-79 heating seasons had 15% more degree-days than 1973-76. (Conversely, 


the summer of 1980 was about 13% hotter than normal. ) 


- The 1975-76 and 1976-77 rainy seasons in California were 60% drier than 


the 1931-77 average. 


- There was a global cold spell in 1812-17; in the summer of 1816, frosts 


were reported every month in New York and New England, and Western Europe had 
Similarly severe weather. 
- In the past 70,000 vears, there may have been several abrupt drops of 


temperature by 5°C over large areas; this may occur as often as once every 


1,900 to 10,000 years. 


Abnormal weather affects both energy supplies and energy demands, giving 


rise to unpleasant second-order impacts. This is illustrated by the 1975-77 











Western U.S. drought [id. 91-92], which reduced regional hydroelectric output 


by about 40%. This deficit made hydro-dependent Pacific Gas & Electric Company 


burn an extra 50 million barrels of oil and was largely responsible for raising 


mh 


PG&E's operating expenses bv 302. Meanwhile, however, water allotuents for 

agriculture--which normally uses 35% of California's water--were reduced by 

over 60%, and extra groundwater pumping to try to make good this loss used 
. | 


about 1 billion kWeh of additional electricity. (In normal years, California's 


largest single use of electricity is pumping by the State Water Project.) The 





interaction between energy and water problems could have been even worse if 
proposed coal siurrv pipelines had been operating: they would have had such a 
low water priority that their operation would probably have been severely cur- 
tailed, contributing to a kind of common-mode failure of supposedly redundant 
hydroelectric and coal-electric systems. 

As drought persisted in the Western states, the Eastern two-thirds of the 
country simultaneously suffered record cold. This raisedheating costs by an 
estimated $4-8 billion and increased oil imports by approximately a further 150 
million barrels--a total increase of 200 million barrels worth $6 billion, not 
an insignificant contributor to a weak dollar and a tight world oil market. 

The unprepared natural-gas industry burned 12% of its stored inventory in 
November (compared to zero the previous winter). Some systems were withdrawing 
gas when they normally injected it. One major pipeline company sold its 
reserves pre: aturely; some gas storage areas were so cold that pumping capacity 
was insufficient to retrieve stored gas (id. :94]. Gas supplies ran short, 
putting over a million people out of work in twenty states and costing up to 
$100 million in unemployment benefits. Over 45% of the gas shortfall was in 
Ohio, already hard hit by disrupted coal and fuel-oil deliveries. 

Perhaps the most disturbing feature of this disruptive weather pattern is 
that the same one that causes Western drought and Eastern cold also typically 
causes simultaneous cold weather in Europe and Japan [id. 97). It thus offers a 
potential for severe pressure on world oil markets if it happens to coincide 
with a supply shortfall. Recent shortfalls have been only by a few percent; a 
simultaneous north-temperate-zone cold spell could roughly double this magni- 
tude. The possibility of bad weather not only heightens vulnerability to 
routine shortages or deliberate disruptions of energy supply; the disruption 
can be deliberately timed to coincide with bad weather. Thus in Britain, the 
onset of winter is commonly associated with militancy among fuel and power 
workers in recollection of the effectiveness of the miners’ strike in toppling 


the Heath Government in i974. Sabotage of electric grids could likewise be 


timed to coincide with peak loads or major plant outages or both. Whether in 








30 
one country or globally, improved energy efficiency (Chapter 6) would offer an 
effective hedge against these eventualities by greatly reducing both the amount 


of energy needed and the sensitivity of that amount to weather. 


2.1.5. Limited sudstitutability. 


The infrastructure for using fuels, whether directly or via electricity, 
has Deen built on the assumption that several competing fuels will always be 
readily available in essentially unlimited quantities. Each fuel-using device, 
on che other hand, is usually built to take a particular fuel assumed to be 
cheaper than its competitors. The lifetime of these devices typically ranges 
from one to several decades. Until such recent developments as the commercial- 
ization of fluidized-bed boilers [Patterson & Griffin 1978], it was costly and 
uncommon for boilers to be Jesigned to burn more than one or at most two kinds 
of fuel--especially to handle both solid and liquid fuels, because they require 
different kinds of equipment to store and feed them, and the duplication of 
investment would normally be unattractive. Accordingly, a complex pattern of 
past investments locks each region and each industry into a relatively inflexi- 
Sle pattern of fuel and power use, limiting its adaptability to interruptions. 

This problem is perhaps most familiar to electric utilities, whose plants 
represent the largest fixed industrial asset in the whole economy. Past fuel 
interruptions (the 1973-74 oil embargo, the 1978 coal strike, the 1975-77 
Western drought, occasional natural gas curtailments, generic nuclear shut- 
downs) have highlighted regional concentrations om ome or another fuel. Utility 
plans for 1989 [Department of Energy 1981:1:4-12] reflect continuing fuel 
specialization of different kinds in virtually every region: over 75% coal 
dependence in the East Central states; over 50% oil in the Florida and Southern 
California/Nevada regions; over 25% oil in the New York, New England, Northern 
California/Nevada, and Arizona/New Mexico pools; over 50% gas in South Central; 
25-50% nuclear in New England, Pennsvlvania/New Jersey/Maryland, Chicago area, 
and several others; and over 60% hydro in the Pacific Northwest. This might at 
first sight look like healthy diversity; but it also guarantees that a major 
interruption in the supply of any of thes@ sources will put at risk the 
electrical supplies of at least one substantial region. 

Substitutability is limited not only between fuels but between difference 
types of the same fuel. There are different kinds of coal whose content of 
ash, sulfur, and heat vary respectively by one or two orders of magnitude, at 


‘east ome order of magnitude, and a factor of at least two. Conventiona! fur- 


naces can burn coal only within a specified, often rather narrow, range of 














chemical and physical properties. On a home scale, most stoves perform effi- 
ciently, cleanly, and safely with either hardwood or softwood but (in the 
absence of special design features) not both. Leaving aside the immense vari- 
ety of refined products (many of which are not interchangeable in end-uses) and 
considering only crude oil, there are many different kinds differing in speci- 
fic gravity (heaviness), chemical composition, and trace impurities such as 
sulfur and heavy metals. Refineries normally need to blend crude oils of dif- 
ferent composition--a logistical problem of considerable complexity at the best 
of times, but one of critical importance. "In some areas of the country large 
refinery complexes depend on a specific crude oil supply [whose] ...interruption 
...could shut down [the]...plane. If this refinery were the sole supplier of 
particular feedstock to a petrochemical plant which was one of a very few mak- 
ing specific products, such as toluene, tetraethyl lead, butadiene, specific 
solvents, or other chemicals, the loss could be...of strategic importance." 
(Stephens 1973:14] Refineries designed for low-specific-gravity crudes cannot 
suddenly switch to high-gravity crudes without developing "bottlenecks" which 
limit their capacity. Refineries meant for sweet (low-sulfur) crudes are not 
built of the special allovs required to withstand the severely corrosive sour 
(high-sulfur) crudes. There are similar restrictions on the purity and heat 
content of natural gas suitable for various kinds of processing, transmission, 
and use. Even in storage of liquid fuels, “clean” tanks, barges, tankers, etc. 
are not interchangeable with "dirty" ones contaminated by crude oil or heavy 
Tuel oils; cleaning vessels is costly and time-consuming. In many complex 
wavs, therefore, prolonged disruption of normal fuel supplies can severely con- 
strain the ability of the fuel-processing and -using industries to improvise. 
In many cases the modifications needed for (say) oil refineries to switch to a 
different kind of crude take many months and cost many millions of dollars; it 


i$ mot just a matter of turning valves [Deese & Nye 1981:40]. 


tr 


.1.6. Unique properties of grid electricity. 


Fossil fuels are in general straightforward and relatively cheap to store 
in Dulk. With reasonable care to protect e.g. piles of coal from spontaneous 
combustion and tanks of crude oil from a@ining moisture, stocks are fairiy dur- 
able. Nuclear fuels (leaving aside possible safeguards problems) are still 
cheaper and more durable to store: for a ten-year supply of low-enriched 
sranium fuel, warehousing charges are infinitesimal and carrying charges add 
less than 1% to the delivered price of electricity. Electricity itself, how- 
ever, is uniquely awkward and expensive to store in bulk. This means that the 


central supply of electricity requires a continuous, direct connection from 
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source to user. This is not required by any other energy system--not even 
natural gas, which interposes substantial storage between processing plants and 
users. It means that interruptions of central-electric supply, having no buf- 
fer storage, are instantaneously disruptive. The electrical link is especially 
fragile because it must not only carry electrons, but carry them in a particu- 
lar, precisely defined time pattern of variation exactly synchronous with that 
of the grid. The serious problems of grid stability which this raises are 


discussed near the end of section 2.2.1. 
2.1.7. Inflexibilities of energy delivery systems. 


A monumental study of the U.S. energy transportation svstem [Congressional 
Research Service 1977:1:84-89] identifies six aspects of system flexibility: 
adaptability to changes in throughput, fuel used to operate, weather, and 
routing; ability to build facilities quickly; speed; and ability to handle 
joint shipments of different fuels. Several of these, plus ability to reverse 
direction, require brief amplification: 

- Volume. Normal fluctuations in demand, let alone the abnormal require- 
ments of substitution for other interrupted supplies, make it desirable to be 
able to change the amount of energy transmitted, quickly and within wide 
limits. All present means of coal transportation have this property insofar as 
they need no fixed or minimum throughput. Railroad and barge traffic cannot 
greatly expand without overloading key track sectors, locks, etc., but at least 
within those limits the volume is free to fluctuate. For oil, pipeline routes 
and capacities are fixed; trucks are highly flexible; and railways and water- 
ways are intermediate in flexibility, having fixed trunk routes but ability to 
move equipment along them to where it is most needed (and, in the case of rail- 
wavs, to add spur lines). This ability paid off in 1940-42, when the Atlantic 
Seaboard was 95% dependent (and oil shipments to England were wholly dependent) 
on coastal shipping vulnerable to German submarines. Twenty thousand idle 
railway tank cars were reconditioned and put into oil-hauling service "almost 
overnight” [id.:171-172]. Synthetic rubber tanks and barrel-loaded boxcars 
were also pressed into service. The oil unit trains "were highballed from one 
railroad to another" on "fifty railroads and fifty-six routes," achieving a 
peak shipment rate of 0.93 million barrels per day. Commandeered barges also 
moved an average 1.3 Mb/d om the Mississippi. Surprisingly, the same need 
might arise even todav, since there is still no crude-oil pipeline serving the 
East Coast refineries (New Jersev, Pennsylvania, Delaware), and an interruption 


of Atlantic or Gulf tanker traffic would shut them down. Only the Colonial 











Pipeline System, with a capacity of approximately 2.1 million barrels per day, 


Provides substantial capacity for importing refined products to the East 

Coast. Should that pipeline not operate, replacing its product flow (to say 
nothing of bringing crude to the East Coast refineries) would require the equi- 
valent of more than 200 World War II T-2 tankers (16,000 dwt) on a continuous 
l3-day-round-trip shuttle between Galveston and New York--approximately the 
whole U.S. coastal tanker capacity, and enough to cause a monumental traffic 
jam in the ports [Stephens 1973:114]. 


- Facilities construction. Road shipment, though usually the most costly 





and energy-intensive, also generally offers the shortest construction times and 
the greatest topographic freedom of choice. Its infrastructure is also mlti- 
Purpose, not specialized to fuel supply like gas and power lines. Railway and 
waterway facilities are usually too costly for any but large users to buy them. 


- Speed and joint shipment. In coal shipment, the cheapest method (barge) 





is also the slowest, least flexible, and most weather-vulnerable; the most 
flexible in routing (truck) is also the costliest; railways offer various 
compromises between flexibility and economy. All can keep different kinds of 
loads separated. So, surprisingly, can pipelines*, which can move their 
contents thousands of miles in a few days. Electricity moves instantaneously. 


- Reversibility. Oil and gas transmission pipelines now in operation are 





generally unidirectional [Congressional Research Service 1977:1:14]. They can 


be reversed, and have been (id.:178,181), by modifying valves and compressors. 





*For example [Congressional Research Service 1977:1:198-200], the Colonial 
Pipeline System, the largest and probably the most complex in the world, has 
three adjacent pipes, the largest having a diameter of 36" (91 cm), fed from 
ten source points and distributing to 281 marketing terminals. Thirty-one 
shippers dispatch 120 varieties of products to 56 receiving companies. In 
1973, after an investment of over $527 million since 1962, nearly 2000 miles of 
main pipe and over 1500 miles of lateral lines containing over 1 million tons 
of steel were being operated by fewer than 600 total employees; it took a 
product batch 12 days to move from Houston to Linden NJ, powered by 84 pumping 
stations (totalling 826,075 horsepower or over 600 MW) using over 2 GWe-h per 
year--enough to run for a month in 1973 all the houses in Louisiana, Georgia, 
Mississippi, anu South Carolina. It took ten companies just to supply the 
valves for this extraordinarily complex engineering project [Stephens 1973: 
115]. The Colonial system accepts minimum batches of 75,000 barrels, occupying 
a l2-mile (19-km) length of pipe (an amount which takes an hour and a half to 
pass a fixed point), and separates them from adjacent batches of different com 
position by inflating between them a water-filled rubber "batching sphere” that 
fits the inside pipe diameter. Constant monitoring of the specific gravity of 
transmitted product enables operators to divert the “interface"--the small mix- 
ing zone formed by leakage around the batching sphere--into holding vessels for 
reseparation or blending into products of saleable purity. The order of batch- 
ing is carefully defined to minimize contact between incompatible products, a 
full product sequence requiring ten days. For products more viscous than the 
nigher-distillate heating oils, pipeline shipment is impractical. 
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Dil unit tank trains [id.:255] are even more easily reversible, requiring only 
appropriate loading/unloading equipment. Electrical grids are usually reversi- 
dle without modification, subject to requirements of safety, metering, and 
stability (discussed below). In contrast, in the 1977 coal strike, Federal 
authority, though extensive (protecting coal distribution, requiring emergency 
electric interties, mandating allocations and sales of coal, etc.), did not 
extend to physically moving coal [Subcommittee on Energy & Power 1978:18], but 
most of the coal was not available to be moved anyhow because most power-plant 


coal depots had equipment onlv for unloading coal onto piles, not for reloading 


it for shipment to someplace else [id.:9]. 
2.1.3. Interactions between energy systems. 


An energy system can fail because it does not receive external, auxiliary 
energy it needs in order to run. Gasoline pumps, for example, generally run on 
grid electricity. On the day an Amoco® gas station powered by an array of 
solar cells was being dedicated in 1980 in West Chicago, a violent thunderstorm 
cut off all power in the area, and the solar-powered station was the only one 


in operation [Energy Insider 1980:4]. (The American Petroleum Institute has 





published (Federal Emergency Management Agency 1979:22-23] an excellent guide 
to nine emergency methods of dispensing gasoline in a power failure, using 
motor vehicles, lawnmowers, bicycles, portable engines, or human muscles for 
motive power.) Electric power failures have often shut down sewage-treatment 
plants that were not powered by their own methane byproduct. Most municipal 
water plants require grid electricity to operate [Nevin 1969; Pickering 1969]; 
$0, currently, do most oil refineries [Stephens 1970]. About half of U.S. 
domestic oil extraction depends on electrical suppies [Stephens 1973]. Except 
for the small fraction of U.S. coal carried in slurry pipelines, virtually all 
coal transportation depends on diesel fuel [Energy & Defense Project 1980:77], 
so a cutoff of imported oil "may threaten our supply lines for coal as well" 
Congressional Research Service 1977:1:75]. Failure of power for dewatering 
pumps can flood coal mines so badly as to force their abandonment. All heavy 
machinery depends on a continuous supply of lubricants from the oil industry. 
Refineries need electrically pumped cooling water. Many power stations depend 


Xn diesel generators for safe shutdown and to run critical control and protec- 


rr 


ive circuits if the stations and their grid supplies fail. Some fuels, too, 
are coproducts of others (natural gas liquids from natural gas processing, for 


example), and still others, like heating oil or propane, can become scarce if a 


Shortage of, sav, natural gas forces buyers to substitute [Federal Emergency 
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Management Agency 1979:1]. Interactions between different forms of energy 
supplies can leave even the homeowner stranded: most oil- or gas-fired 
furnaces need electricity to run their pumps and igniters. In short, any 
disturbance in the intricately interlinked web of fuel and power supplies can 
spread out in complex ripple effects at all levels, from primary supply to 
end-use, complicating substitutions and exacerbating the initial shortage. 

Another worrisome interdependence of supposedly independent energy systems 
can arise from their colocation. Broken water mains can short out electric 
cables. A Liquefied-gas tanker accident could destroy a power station or 
refinery. Fire and explosion can propagate between nearby pipelines or through 
a tank farm. Exploding gas mains can simultaneously disable electric and 
telephone cables located in the same tunnels under city streets. Early on 13 
February 1981, am hour before rush-hour traffic, some 3 to 12 miles of Louis- 
ville's streets were instantly torn up by exploding sewers, apparently filled 
with hexane leaking from a factory a mile from the point of ignition [Marshall 
1981). Such am accident could easily knock out all under-street utilities at 
the same time. During the British conversion to North Sea gas, some public 
telephone booths started exploding: the higher gas pressure was too much for 
old joints, and the leaking gas entered adjacent telephone cable conduits and 


seeped up into the booths, ready for someone to walk in with a lit cigarette. 
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capital intensity. 


Capital intensity reflects resource intensity and thus indirectly measures 
the difficulty of building a system with limited resources. High capital 
intensity also has important operational, financial, and social consequences. 
Most modern energy supply systems are extremely capital intensive. Some, such 
as electric utility plant, are the most capital-intensive in the whole economy, 
with a capital/output ratio several times that of manufacturing industry. In 
general, synthetic-fuel and frontier (Arctic and offshore) oil and gas systems 
require about ten times as much capital per unit of capacity for delivering 
additional energy to final users as did the traditional direct-fuel systems 
(such as Appalachian coal, Texas oil, and Louisiana gas) om which the American 
economy was Dduilt. Central-electric svstems, in turn, are about ten times more 
capital-intensive still [Lovins 1977b,1978]. The resulting capital charges 
generally exceed the operating costs and profits that are the remaining compo- 
nents of energy price. Carrving charges for a plant costing, say, $2 billion 
‘such as a nominal 50,900 dbl/d synfuel plant) can easily exceed half a million 


dollars per day ($6 per second), pavable whether the plant runs or not. 
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This has several important consequences. First, the designers will be un- 
able to afford mich redundancy--major backup features that cost a lot but are 
seldom used. Second, there will be a strong temptation to skimp on downtime 
for routine maintenance-~-a temptation commonly indulged in reactor operations. 
A similar reluctance to shut down oil refineries for maintenance if thev can be 
kept running without it means that minor leaks which in prior years would have 
deen quickly fixed are now often allowed to continue for a year or more. 

The prevalence of known but unfixed leaks and other faults greatly increases 
doth the likelihood of fire and the workers’ exposure to toxins and suspected 
carcinogens. These economically motivated risks are a chief cause of refinery 
strikes by the Oil, Chemical and Atomic Workers’ Union. 

Another result of high capital intensity is limited ability to adapt to 
fluctuating demands. Quirk and Moriarty [1980:93] point out that the Natural 
Gas Policy Act of 1978, passed in the wake of the 1976-77 winter gas shortages 
and giving absolute priority to residential and small commercial users, may 
have a perverse effect. These users, who may not be interrupted, have the most 
temperature-sensitive demand, whereas industrial customers, who must be inter- 
rupted first, have the least. In a cold-weather gas shortage, a utility with 
many uninterruptible customers might reap windfall profits from unexpected 
extra sales, while a utility selling mainly to interruptible industrial custo- 
mers might go into the red by losing sales needed to support unaltered capital 
charges. Profit-maximizing utilities mav therefore seek to raise their propor- 
tion of uninterruptible, temperature-sensitive customers, thus increasing tocal 
national vulnerability to a cold-weather gas shortage. 

The economic need for capital-intensive plants to run nearly continuously 
places a high premium on the correctness of engineering expectations that they 
will prove reliable. Technical mistakes, bad weather, external interference, 
etc. can produce massive economic penalties as well as disrupting energy sup- 
plies. For example, the financial fallout from the Three Mile Island accident 
--in terms of reduced bond ratings, higher cost of money, and the like--is 
proving more crippling to General Public Utilities than the direct costs of the 
cleanup or of buving replacement power. High capital intensity also commonly 
reflects a degree of complexity that hampers diagnoses and repair of faults and 
limits available stocks of costly spare parts (section 2.3). The corresponding 
managerial complexity places additional stress om another scarce resource, 


especially scarce in emergencies--the attention of gifted ssaagers. 


2.1.10. Long lead times. 
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The time it takes to build a major energy facility--of the order of a 
decade, or irreducibly perhaps half that--contributes to its capital cost and 
investment risk. It requires foreknowledge of demand, technological and 
political conditions, and costs further into the future, when forecasts are 
dound to be more uncertain. This uncertainty imposes a severe financial 
penalty on bad guesses, especially overconstruction--a diseccnomy of scale 
comsidered further in Chapter 5. Frequently, long lead times require major 
Tacilities to be built, or at least their designs frozen, before significant 
Operating experience is gained with their evolutionary predecessors. This 
tendency to run ahead of sound engineering experience tends to encourage costly 
Mistakes which may seriously affect long-term energy supplies. 

Long lead times also create risk even if forecasting is perfect. This is 
because people considering in 1981 a billion-dollar commitment to a plant that 
cannot be finished until 1991 and must then operate into, say, the 2020s want 
to know with confidence the conditions of finance, regulation, and demand 
throughout this period. But they want this certainty in a society whose values 
and institutions are in rapid flux--a society that changes its politicians 
every few years. If democracies are to retain their flexibility and adaptive- 
ness, thev must remain free to change their minds. This is not a problem of 
accurate forecasting but of maintaining political degrees of freedom essential 
to our concept of governance. It means that the certainty desired by the pro- 
moters simply cannot be given. This tension--perhaps a fundamental incompati- 
bility between the characteristics of many modern industrial investments and 
those of a pluralistic political system in a changing world--is bound fo 
express itself somehow, and is an inherent source of vulnerability in these 


facilities or in the adaptability of our institutions or both. 
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Specialized labor and control requirements. 


Modern society is becoming disturbingly dependent on skills possessed by 
small numbers of highly organized people. Air traffic controllers, for 
example, are virtually irreplaceable, at least on short notice. A 24-hour 
strike by 1500 controllers and allied staff (presumably 500 per shift) recently 


did what Hitler was unable to do--close British airspace [Los Angeles Times 





1981b]. Likewise, modern systems for the continuous bulk delivery of energy 
are exceedingly complex and require meticulous automatic and manual control 
which is understood and can be run and maintained by only a few highly trained 
specialists. Railway loading operations are almost unique in having so far 
largely resisted automation, retaining human judgment instead of computeriza- 


- 


tion [Congressional Research Service 1977:1:267]; gas and oil pipelines and 
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electric grids are already almost completely computerized. This is indeed 
essential because of their complexity. 

An oil pipeline, for example, needs several dispatchers, but they could 
mot umaided xeep track of the status of pumps, valves, flow rates, batch loca- 
tions, schedules, metering, costs, etc. (Just a 3°F change, for example, in 
the temperature of the entire 36" Colonial pipeline, or a 150 lb/in@ pres- 
sure change, would change its volume by some 10,000 barrels worth severai 
hundred thousand dollars [id.:200-201].) Stephens [1973:34] remarks that in 
one major pipeline system, “One small room, in a large southern citv, houses 
the complete...control system [for]...several states....Forced entry to the 
computerized center [and low-technology sabotage]...could suddenly put the 
entire system back on hand operation. Each control valve, of many hundreds, 
would have to be visited, but now only a few men are available to run the 
svstem. There are no repair crews except contract crews in most cases." The 
Plantation and Colonial pipelines, supplying most of the Eastern Seaboard's 
refined products, not only parallel each other and interconnect at many vulner- 


able points; the control systems for both are in the same building. "A repeat 





of the University of Wisconsin action by saboteurs could do serious damage to 
these operations" [id.:114]. (Colonial has installed a backup control center.) 

Perhaps most dependent on control automation are electric grids, where 
transient events such as lightning bolts or routine circuit interruptions often 
require actions within hundredths of a second to prevent damage. Giving effect 
to control decisions throughout the far-flung grids of wires and pipelines 
requires complete dependence, therefore, on computer decisions not first 
checked by human judgment, and on electronic telecommunications links-~a 
dependence whose disturbing consequences are explored in later sections. 

The specialized nature of the control systems, and of maintenance opera- 
tions needed to maintain both tnem and the devices they control, concentrates 
immense power in few hands. The economic and social cost of energy disruption, 
let alone the direct financial damage incurred by carrying charges on idle 
equipment, place "power to the people” in tce hands of very small numbers of 
people well aware of that power. As an official of the British power workers’ 
imion remarked shortly after a coal strike had brought down the Heath Govern- 


- 


ment in 1974, “The miners brought the country to its knees in eight weeks; we 


could do it in eight minutes.” His colleagues have since repeatedly threatened 
national blackouts as a prelude to negotiations for various desired conces- 


sions, including (in one recent instance) dDasic wages of up to $50,000 per year 


‘Daily Mail 1979]* Ironically, the Conservative Government's well-known desire 





to reduce vulnerability to future coal-miners' strikes by substituting nuclear 


power would increase vulnerability to disruption bv even more specialized and 





*Israeli power workers, as we write this, are gradually blacking out the 
country [Los Angeles Times 198ln}. 
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nearly as militant workers in power plants and power dispatching centers. 


Electrical supplies have also become a bargaining chip in Australia [Straits 





Times 1980!) and elsewhere, as have water supplies, sewage treatment, and other 
utilities essential to public health and safety. However responsibly a union 
or management able to control such kev utilities may behave, the very possibil- 
itv of disruption tends to foster suspicion and intolerance if not worse, fur- 


ther increasing the social tensions which themselves contribute to the risk. 
2.1.12. Adaptability of fuel distribution systems to other materials. 


Virtually all analyses have considered the vulnerability of energy systems 


only to interruptiors of supply. Many systems can, however, be interfered with 





in other ways at least as damaging--large-scale versions of putting sugar in a 
Zasoline tank. A few examples make the point: 

- It would probably not be difficult to introduce a foreign substance into 
crude o11 being stored or pipelined to many refineries. Such substances might 
include radiotoxins which will neither affect nor be affected by processing but 
would be widely dispersed by subequent burning of the refined products. Like a 
Suspicion of botulism in canned foods, they could make substantial amounts of 
petroleum products unfit for use (or, for that matter, for destruction by con- 
ventional means), and could be an effective means of extortion. Alternatively, 
certain substances could be introduced which are potent poisons of refinery 
cracking catalysts. Since most cracking catalysts are in fluidized rather than 
fixed beds, with a residence time of order seconds, poisoning them has mainly a 
Nuisance value, requiring more catalyst to be replaced. Before crudes are 
hydrocracked, thev also go through a demetallizing stage to remove most of the 
nitrogen, sulfur, nickel, and vanadium, and this stage uses relatively poison- 
resistant catalysts. Poisoning the very large volumes of oil in pipelines or 
storage to a level sufficient to interfere seriously with refining would in any 
event require large amounts of contaminant, as the catalysts are not as sensi- 
tive to heavy=- or alkali-metal poisons as (say) photographic emulsions are to 
mercury. Nonetheless, there are some special circumstances in which this type 
of potential interference is worth considering. 

- The national grid of natural-gas pipelines--over a million miles for 
transmission and distribution--offers an inviting route for dispersing unpleas- 
ant materials. In early 1981, the Environmental Protection Agency found that 
Natural Zas systems in Southern California, Chicago, and Long Island had become 
accidentally contaminated with liquid PCBs (polychlorinated biphenvls), an 
extremely persistent and toxic liquid whose manufacture was banned in the U.S. 
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in 1976 but which is still widely used in transformers, capacitors, etc. 








(Billicer 1981]. Not only retail distribution systems but also some segments 
of imterstate pipelines and their gate stations were contaminated. EPA thinks 


rr 
~ 


he PC3s may have entered the gas lines as a pump or 


i 


Ompressor Lubricant many 
years ago, perhaps via leaky seals. The PCBs detected in retail customers’ 
meters are not so far believed to mean that burning the gas had actually re- 
Leased significant amounts of PCBs indoors. Nonetheless, there are cheap, very 
disagreeable substances which could be deliberately introduced in bulk into the 
national gas grid from any of thousands of loosely supervised access points. 
such sudstances could be widely distributed and released before likely detec- 
tion. Some could contaminate the inside of the pipelines--the third Largest 
fixed asset in all American industry--so as cto make them very difficult to 
clean up. Whether a major public hazard could be caused in this way would 
require further analysis at an i .discreet level of specificity; but it appears 
there is, at a minimum, a potential for causing public anxiety and disruption. 
- Another category of potential threats might involve the fuel distribu- 
tiom system or local storage tanks. Apparently some organisms promote the gel- 
Ling of Liquid oil; others have been developed to eat oil slicks at sea. It 
may Decome possible for self-reproducing organisms of either kind to become a 
threat, accidentally or deliberately, to oil storage and processing systems*. 
It is hard to say whether this would be easy or difficult, and it may seem far- 
fetched; Dut strikingly effective instances of biological sabotage are already 
known, ranging from releasing moths in a cinema to sowing spores of certain 
mushrooms which, om sprouting, hydraulically fracture any concrete that has 
meanwhile been poured over them. The adaptability of organisms and the ingenu- 
ity of some amateur biologists suggest that biological threats cannot be dis- 
counted. Already, such accidental infestations as Mediterranean fruitfly, 


Corbicula in power plants (Ch. 1.2.1), kudzu on much Southern land, and water 





Nyacintns om waterways suggest a considerable potential for mischief. 

- Finaliy, an analogous problem may exist with electricity, because as 
much harm can de caused Dy increasing as Dy interrupting its supply. Some - 
manipulations of electrical control systems may de able to increase grid vol- 
tages to levels which damage not only generating and transmission equipment dut 
also widely dispersed distribution and end-use equipment. This has already 
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nappened Dy accident, as in restoration after the July 19 New York blackout 
Jescridbed in the following section. Aiternatively, persistent low voltage or 
Speration of only ome of severai phases on multiphase Lines can cause epidemics 
9f burned-out motors and other equipment over a wide area: Stephens (1970:149) 
notes an oilfield operation that lost 153 motors in ome evening ina this way. 


Repairing sucn widespread damage to end-use devices can de extremely siow and 





"Oil stored in south African gold mines was repor 
a 
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dDacteria, making it very nard to ex-extract (ERAB 1960:05). Some r 
ducts can de ed tor only a tew months to vears unless stabi.ized Dv spec- 
l 


r 
s 1981'; presumably destabilizing additives also exist. 
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costly. As noted below (Chaprers 2.2.3 and 3.2.3), analogous interference with 
Zas distribution pressures can endanger large numbers of end-users simultane- 


ouslv, even on the scale of an entire city. 


=: 


2.2. Graceful Versus Catastrophic Failure in Energy Systems 





The previous section sas identified some elements of modern energy systems 
that make them vulnerable to the threats noted in Chapter 1. But such a cata~ 
logue cannot capture the interactive vulnerability of a whole energy svstep. 
This section therefore examines several case-studies of ungainly failure, and 


some of energy systems that failed with grace. 


2.1. The 13-14 July 1977 New York City blackout. 


The failure of the 60-Hz electric power grid in New York in July 1977 was 
not the first or the largest to occur there. In 1965, a cascading power fail- 
ure originating in a malfunctioning relay in Canada interrupted the electrical 
supply of most of the Northeastern United States. Some thirty million people 
were blacked out for anywhere from one to 13-1/2 hours. A load totalling 43.6 

We--23% of 1965 U.S. peak demand or 18% of 1965 installed generating capacity 
--was lost [Federal Power Commission 1977:26]. On 13 July 1977, three days 
after the Chairman of Consolidated Edison Co. of New York had said he could 
"zuaranctee" that a recurrence was remote [Congressional Research Service 1979: 
142), nearly nine million people were blacked out for 5-25 hours through "a 
combination of natural events [lightning], equipment malfunctions, questionable 
system design features, and operating errors" coupled with serious lack of 
preparation to use available facilities to prevent complete failure [Federal 
Energy Regulatory Commission 1978:1]. 

Geography and operational circumstances contributed to the 1977 blackout. 
The New York City grid relies heavily on imports of bulk power in a narrow cor- 
ridor from the north, where power is available at relatively low cost and can 
be celivered overland without requiring expensive underwater cables. This 
clustering of Lines increases vulnerability to storms and sabotage. There are 
some interconnections in other directions, but in July 1977, one key link was 
Inoperable because a phase-regulating transformer, after causing several earli- 
er local power failures, had failed beyond repair ten months earlier (it even- 
tually took over a vear to replace (Subcommittee on Energy & Power 1977:34,149- 
154;1978a:44,95]). Three generating plants on the Con Ed system were also down 


for repair: the Indian Pointe 2 nuclear plant (373 MWe), with a failed pump 
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seal; Bowline Joiner #2 (601 MWe), with a boiler problem; and Astoria #6 (775 
MWe), with a turbine failure. Within the Con Ed area, therefore, onlv 3.9 Gwe 
Was Deing zenerated to serve a load of 6.1 Gwe, and the rest was being imported 
through six interties. [tf is the successive failure of these transmission 
systems, and their interaction with local generators, that led to the system 
failure. There was plenty of generating capacity available in the “pool” of 
adjacent utilities with which Con Ed was interconnected, but bw the late 
evening of 13 July i977, there was no way to deliver that power to the city. 
Perhaps the best description of the failure sequence is by Boffey [1978]: 


The trouble began...when lightning struck aln imperfectly grounded 
transmission-line] tower in northern Westchester County and short-circuit- 
ed two 345-kilovolt lines....[P]rotective relays...triggered circuit 
breakers to open at both ends of the affected lines, thus isolating the 
problem from the rest of the svstem. This is exactly what the circuit 
Sreakers are supposed to do. However, they are also supposed to reclose 
automatically once the fault dissipates, and this they failed to do. One 
transmission line failed because of a loose locking nut [which released 
air pressure from a circuit breaker: Clapp 1978:10)...; the other because 
a reclosing circuit had been disconnected and not vet replaced.... 

Two other facilities also tripped out of service....A nuclear reactor 
(Indian Point 3] shut down automatically when the circuit breaker that 
opened to contain the lightning fault also [bv a design fault] deprived 
the reactor of anv outlet for its power....[Alnother %5-kilovolt line--a 
major tie across the Hudson--tripped out because a protective timing de- 
vice was designed improperly....Thus, in one stroke of misfortune, Con Ed 
lost three major transmission lines and its most heavily loaded generator. 

Even so, Con Ed regained its equilibrium by importing more power on the 
remaining tie lines and by increasing its own generation somewhat [but did 
mot restore a safety margin]....Then lightning struck again...and short- 
circuited two more 345-kilovolt lines. Again there was a malfunction. One 
line reclosed automatically [but]...the other remained open because a re- 
lav had been set primarily to protect a nuclear reactor (which, tronical- 
ly, was out of service) rather than to facilitate reclosing of the line 

..The loss of the line...caused a temporary power surge that tripped 
Sut another 345-kilovolt line. This should not have happened but did, 
Decause of a bent contact on a relay. 

Con Ed's control room succumbed to confusion and panic....[The] system 
»perator (assumed]...a particular transmission line was still in service 
_and)...failed to read a teletype [saying it was down]....Moreover, 
because of Con Ed's antiquated control room layout, he was unable to see 
a more dramatic indicator in another room--a flashing screen with a high- 
pitched alarm. The personnel there knew the line was out but failed to 

11 Hle ignored [seven]...suggestions from the power pool that he 


tell him....[#] 
shed load. Then, as ituation deteriorated, he...dumped his...respon- 
sidi‘ity on his bos shief svstem operator, who sat at home in the 
jark reading diagrams, .. a kerosene lantern and issuing orders over the 
phone....The chief ordered voltage reductions--but these were too little 
and too late. Eventually he also ordered that a block of customers 5e 
disconnected. whereupon the confused operator (rendered the load-shedding 
>ontrol panel inoperable bv apparent!v turning)...a master switch the 
wrong way. 

The performance of Con Ed's generators was equally erratic. Con Ed's 


System operator delaved 3 minutes...before requesting a fast load pickup 
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from generators that were supposedly able to respond in 10 minutes. He 
[then] got only half the power he expected--and only 30% of what Con Ed 
had incorrectly told the power pool it could provide. Some equipment 
malfunctioned; other units were undergoing roufine inspection but had not 
Deen removed from the fast-start capability list; some were not even 
manned. (All the night-shift operators had been sent home, and the 
remote-start capability had been removed some years earlier: Subdcommitee 
on Energy & Power 1977:32,100-101. Ac most 55% of Con Ed's total in-city 
generating capacity was actually operable: id. 1978:53.] Similarly, when 
Con Ed sounded the maximum generation alarm some 10 minutes after the 
second lightning strike, it again failed to get the anticipated response 
from its 30-minute reserve generators. 

As the system cascaded toward collapse, heavy overloads caused the 
failure or deliberate disconnection of all remaining ties to neighboring 
utilities. Con Ed['s]...last hope was an automatic load shedding system 
that had been installed after the 1965 blackout. [It] worked beautifully 
to disconnect customers....But it also unexpectedly caused a rapid rise in 
system voltage that caused a major generator to shut down....The remaining 
generators could not restore equilibrium. Eventually, protective relays 
shut them down to prevent damage...[and] the city was blacked out. 


Mearly twelve weeks later, on 26 September 1977, another thunderstorm 
tripped four transmission lines with six lightning bolts. Automatic reclosing 
equipment again failed to perform, shutting down 40% of Con Ed's generation. 
Oniy a more alert operator response in shedding Westchester loads prevented a 
second, more serious blackout from spreading again across the city. On tuat 
occasion, .he equipment failures included an out-of-service instrumentation 
channel at Indian Point 3 [Clapp 1978:22], a wiring error in a relay [:23], 
deactivation of a reclosing circuit by the unexplained placing of a switch in 
the wrong position [:23], and a defective relay [:25]. Like earlier equipment 
faults, these resulted from "serious failures in inspection and testing” [:39]. 
Though local trip svstems prevented in 1977 most of the serious damage that the 
1965 blackout had caused to 1.5 Gwe of generating equipment [Joint Committee on 
Defense Production 1977a:23], many of the underfrequency relays meant to shed 
load automatically in 1977 did not initially operate. 

Serious, tultiple operator errors, reminiscent of those identified in the 
Three Mile Island accident by the Kemeny and Rogovin reports, also dominated 
the July 1977 blackout. Many of the training and procedural problems had 
already been identified in the 1965 blackout [Subcommittee on Energy & Power 
1977:53-65, but not fixed. Lack of unambiguous linguistic conventions like 
those used in air traffic control contributed to the confusion | Federal Energy 
Regulatory Commission 1978:139]: different operators concealed their meaning 
from each other and, on occasion, from themselves. The svstem operator was 
ipparentliv hard of hearing anyway [Subcommittee on Energy & Power 1977:46), 


perhaps contributing to his poor performance in communicating over the tele- 


phone from a noisv and doubtless chaotic control room. 








Three technical features of the 1977 blackout deserve special attention. 
First, 1f was of a character unforeseen in anv official design criteria. The 
ator concluded: “The inability to achieve stable isolated 
Speration (i.e. without interties to adjacent areas] stems from a general 
failure to think through the problems that transmission losses can create. For 
>xample, virtually no planning consideration has been given to the generation 
r@serves needed in the event of transmission losses. Installed generation 


r2serve capacity is determined solely with reference to potential generation 





y, the Pool's minimum operating reserve criterion...is 
designed to meet generation shortages, not transmission losses |, and...] 
assumes sufficient transmission exists to deliver the members'...reserve capa- 
city to the system suffering the shortage. Where disturbances on the bulk 
transmission system severely limit the ability to transfer power, the Pool's 
existing reserve requirements are inadequate." [Clapp 1978:59-60] This had 
already been clearly noted ir the 1965 Federal Power Commission report to 
President Jonnson--"Cascading power failures are usually the result of insuf- 
Ticient capability within...transmission links"--but neither Con Ed nor Pool 
lowed the logic. The reason Con Ed had not realized that load 
shedding would produce overvoltage and trip the Big Allis generator at Ravens- 


wood was that they had simply never analyzed the behavior of an isolated Con Ed 


Second, the July 1977 power failure produced unexpected secondary conse- 
yuences that seriously hampered recovery. There was inadequate light and power 
for troubleshooting or manually operating major substations [Joint Committee on 
Defense Production 1977a:5]. Auxiliary equipment at power stations--lubricat- 
ing and cooling pumps, boiler feedwater pumps, etc.--failed gradually with 
jeciining voltage, compromising and in some cases modestly damaging major 
equipment | Federal Energy Regulatory Commission 1978:49]. Assessment of the 
status of equipment, and coordination of early restoration efforts, was also 
Nampered bv the complece failure of Con Ed's UHF and VHF radio networks. The 


main repeater had two power sources; one had failed before the blackout and the 
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fner ftaried to start. ‘the backup power supply to the backup repeater station 
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2.$0 failed to operate. This triple failure also exposed shortcomings in 
radiotelephones and direct telephone lines. The Sackup radio repeater was not 
repowered unfti. another emerzency power source could be hooked up two and a 

aif hours later (id.:45 
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Moser ,1smMaving was rhe inexoected!iv rapid loss sf Sressure in 53! needed 

t insulat@® and cool the main high-voltage underground power cables. After the 
/999 Slackout, standby generators had been provided to operate generator lubri- 
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cating pumps and other key protective equipment in power stations. The Federal 


recommended installing standby power for pumping 011 
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to the underground cables too--as Commonwealth Edison Co. had done, for less 
than half a million dollars, in the underground Chicago cable system. Apparent- 
ly Con Ed was unaware of this recommendation. That cost them at ieast five 
Aours in recoverv time in 1977 [Subcommittee on Energy & Power 1977:26-27). 
Thev had thought the cables would hold oil pressure for 4-6 hours [Subcommittee 
on Enerzy & Power 1978a:139], burt pressure actually decaved much faster. This 
caused many short-circuits and some equipment damage, causing further delavs 
which lost more oi! pressure. Finally it was necessary to bring in portable 
generators to run the oil pumps, restore all oil pressure throughout the length 
of the cables, and monitor pressure at all terminations and connections before 
the cables could be safely re-energized [Federal Power Commission 1977:20,46]. 

Third, the July 1977 Con Ed blackout illustrated some general features of 
large (and especially of urban) electric grids that make their operation more 
3:fficult to sustain in emergencies. These can be better understood by refer- 
ence to what happens when power flows in a grid are interrupted. 

Sudden trips (disconnections) of elements of power systems occur commonly 
in the midst of normal operation. If Lightning short-circuits a transmission 
line, for example, automatic circuit breakers open, then attempe to reclose in 
a fraction cf a second and again in several seconds if at first unsuccessful. 
Jsers are aware only of a brief flickering of the lights if all goes well. If, 


Nowever, the fault has not cleared (or the breaker does not work properly), the 


U 


reaker will remain open. If an alternative transmission path is available (as 
it mormally is), the electrical flow redistributes itself within a few cycles. 
This mav overload other lines. They can tolerate substantial overloads for 
short periods without overheating, and can even be run for up to four hours at 
*- _— ey =? _ — -. " oo . A b + ; — d- al = 
their long-time emergency rating without damage, but before time-and-Cempera 
cure limits on the lines are reached, operators must reroute power or shed 
loads to Dring the lines within safe limits. Similar readjustments may also be 


needed after the initial rapid redistribution of power flows that accompany the 


4 


idden trip of a loaded generator. Further, the generator itself must rapidly 
Svoass steam from its turbine in order to avoid serious damage from spinning 
fast without load. Thereafter the turbogenerator cannot be rapidly recon=- 
rected to the grid, DSut must be brought up gradually from almost zero load 
tederal Energy Regulatory Commission 19/8:15-16.. 


sn practice, tne detailed electrical phenomena occurring when normal 5ui« 


Uu 


wer flows are interrupted are very complex and demand elaborate mathematica. 


analvsis. One kind of potentially damaging aberration is rapid transients of 
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(aj stirf mechanical structure jiwnich 
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av de damaged bv [a propagating wave of! stress appearing 


tar from the point of the original shock...idepending} on the form of the 


1 
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ucture and the relative stiffness and strength of its members." Electrical 


Ww 
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networks have analogous elements and properties. ransient surges of high 
voltage can break down insulation in a cable or transformer, thereby causing a 
secondary fault. A current surge can likewise trip a protective breaker and 

vy disconnect a circuit. The electrical properties of long transmission 
lines and (especially) of long underground cables tend to enhance transients. 

Alternating-current power grids can also become unstable by losing their 
synchronization. "In normal operation, all of the [generator] rotors...are 
rotating in precise synchronism. Further, the power output and other electri- 
cal quantities associated with each generator are absolutely dependent on this 
synchronous operation. If a generator is subjected to a sufficiently large 
disturbance,...as...from a nearby fault, it may...‘'pull out’ of synchronism, 
2ven though the original disturbance is momentarv. Once synchronism is lost, 
the power output of the unit drops rapidly" [id.:16-17] and it must immediately 
De taken offline until ready for exact resvynchronization. 

If a power grid is more than momentarily subjected to a load larger than 
if can sustainably supplv, and if "spinning veserve”™ capacity already synchro- 
nized with the grid cannot de drought into full production to make good the 
Seficit, the operating generators will slow down at 4 rate that depends on 
their “inertia constance™ (ratio of stored angvlar momentum to output rating) 
and on the extent to which the change in line frequency changes the load lid.: 
The frequency of the whole interconnected system is thus pulled down below 
the normal 90 Hz. This can cause more power to flow toward the deficit area, 
pernaps further overloading transmission lines [id.:17] and probably tripping 
protective breakers. If protective devices do not work properly, different 
elements of a grid may trv to operate at significantly different frequencies, 
"bucking" each other. This causes enormous internal stresses and, probably, 
serious damage. Some modern turbogenerators of very large capacity (well over 


1 GWe in a single unit) work so close to the yield limits of their materials 


that they have ttle safety margin for the stresses generated bv loss of syn- 
nromization: some will reportedly suffer gross mechanical failure (e.z. dy the 
shafts flying apart) if the frequenev deviates bv one or two percent while 
(nev ar® uncer fu sad 

Transmission lines, because of their electrical properties, are subiect to 
two «inds of mits on now much power they can safely handle: thermai limits, 
set ov cneir ability to dissipate heat to their surroundings without sagging, 

















and system stability limits. "Transfer of power at a given voltage can be 
increased onlv up to a certain level beyond which it becomes impossible to 
Maintain synchronous operation between generators at the...ends [of the line] 
-..-Following a disturbance, it is possible for a machine to operate momentari- 
Lv past the stadilitw Limit and then to regain svnchronism..., but this ability 
1s limited and operating conditions are established to maintain operation with- 
in safe limits allowing for the occurrence of some disturbances." [Econ. Regul. 
istr, 1981:1:2-5] These limits become more stringent at higher voltages 
and with longer lines--both characteristic of the trend towards larger, more 
remotelv sited generating plants. 

One form of this problem was illustrated in microcosm in the New York 
Dlackout. Underground cables, used throughout Con Ed's area, have large dis- 
tributed capacitance (ability to store an electric charge between two separated 
conductors). This capacitance could produce large voltage transients if not 
compensated by series inductances (conductors which store energy in their 


magnetic field; like capacitors, inductances display "reactance," or ability to 
Pp ’ pia 


resist changes in the direction of flow of an alternating electric current). 


Con Ed's "black-start" procedures (i.e. for restoring the grid after complete 
power failure) relied on the windings of baseload generators for about two- 
hirds of the needed inductive reactance, but none of it was initially avail- 
adDle for compensation, and inductive compensation in another critical circuit 
was unusably damaged [Federal Energy Regulatory Commission 1978:47-48]. Efforts 
TO restore the grid rapidly in large sections apparently led to series reso- 


Nance effects (electrical oscillations) between the unbalanced inductive and 


capacitive elements, causing high-voltage transients that damaged cables, 
transformers, and switchgear [id]. Indeed, the tripping of the 844-MWe 
Ravenswood #3 generator was caused dv cable capacitance too: when load-shedding 
removed larze inductive loads (motors) which had previously compensated for the 
cable capacitance, the capacitive surge raises voltages to as mch as 11.5% 
above normal, and the resulting pathological voltage-current relationships 
confused the generator's controls so much that it shut off in self-protection. 
This sealed the fate of the Con Ed grid bv dropping svstem frequency from 60 to 
>/.8 Hz--a level low enough to be sustained dv availadle generating capacity 


automatic load=-snedding already having occurred), but too low to keep power- 


Diant auxiliaries (fuel pumps, draft fans, feedwater pumps, et-.) running fast 
> ~ ** - - - * - 24 . -* ’’ * Th aee 1 © “~ TL. Te 
enough t) suppor he 33 generators still operating. The resulting vicious 





circle of plant faliures and further declining frequency crashed the grid in 
ba _ = = 4 .-3° I2 .* ‘ - oie 

four minutes 1id.:3/°38, Clapp 19/3:1,);. 
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hese stability problems are not unique to New York's cable system; in 
various forms they are emerging nationally. In 1976, the Assistant Director 


Tor Svstems Management and Structuring in the U.S. Energy Research and 


eee 


Development Administration [Fink 1976] stared: 


s becoming apparent that the increasing complexities of the 

nation's electric energy system are rapidly outstripping its capabilities. 
interconnected electric energy systems seem to be evolving into a new 
condition wherein "more" is turning out to be “differenr.™ As they become 
more tigntlv interconnected over larger regions, systems problems are 
emerging which neither are presaged, predicted, or addressed bv classical 
electrical engineering and which are no longer amenable to ad hoc 
solution. 

Up until the past decade the ability of an electrical system to ride 
out a severe electrical disturbance (i.e. to maintain stability) could be 
evaluated on the basis of its ability to remain stable through the first 

: rotor angle swing (about one second) following the disturbance. It is now 
recognized, however, that this condition is no longer sufficient. Instan- 
ces have occurred wherein systems survived for several swings follcwing a 
disturbance before coming unstable due to a lower frequency phenomenon. 

Accordingly, the industry has been devoting considerable effort to... 
studying what has become known as the dynamic stability problem...[and] it 
ls acknowledged that the larger, more tightly interconnected system is 
behaving in a fashion qualitatively different from that of earlier smaller 
systems. 

A systems problem which was not predicted...but which has rapidly 
become the focus of much...attention is...subsynchronous resonance. [It 
was}...standard practice [to install] series capacitors to compensate for 
the inherent inductance of very long lines [i.e. the reverse of Con Ed's 
requirements! When this was done in the case of some lines out west, the 

resonant frequency of the series capacitor-inductance combination was 
close enough to the natural frequency of the shafts of the units involved 
to set up mechanical vibrations which resulted in shaft failure. The 
phenomenon is amenable to anaivsis bv available theory, but the necessary 
tools were not readily available and the problems were not anticipated. 

As an example of a future, potentially important problem outside the 
scope of classical electrical engineering, we point to the fundamental 
problem of information transfer and decision making in the case of 
multiple independent control centers, whose decisions affect primarily 
their own portions of a common interconnected svstem. In actuality the 
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action taken bv any ome such center affects the whole....[A]nalyzing... 
effective control strategies...is in its infancy.*** 
Tad , * . 


s electric energy system tn the United States is one of the most 
echnical systems in existence. Unlike most other industries, the 
al components do not operate independently but are tied together 
nteracting svstem covering most of the continental United States, 
deliberate or inadvertent control actions taken at one location 
“an within seconds affect the operation of plants and users hundreds of 


wherein 


miles distant....{Tlhe introduction of complex new technologies into the 
Pxisting, alr2eadv-complex svstem ,and the need to consider tizhter fiscal 
anc environmenta. constraints compound;...the complexity of the svstem. 

The point of all this is that there does not vet exist anv comprehen 
sive applicable dSodv of theory which can provide guidance to engineers 
responsible for the design of systems as complex as those which wiil de 
required pevond the next gzeneration.....Tjhere will be...problems of great 
importance which will de quite different from today's problems, and the 
“onceptual tools and underlying theory required for their effective 
sOlution have aot vet seen developed. 








in short, there is a good deal about the operation of modern large-scale power 


grids that able engineers are hard pressed to anticipate even in normal opera- 


wee 


tion. In abnormal operation, as Con Ed found, their complexity can be suffi- 
cient to defy a priori analysis. This is in itself a source of vulnerability 
To mistakes, failures, and malice. We may well find, as power systems evolve 
in the present direction, that they have passed unexpectediy far devond our 


aDilitv to foresee and forestall their failures. 


2.2.2. Military vulnerability. 


Even when energy systems were considerably simpler than modern electrical 


zrids, they proved attractive targets in wartime. The Energy and Defense Pro- 


ae 


ject (1980:19-29) has found several such cases instructive. Hitler's Germany 
used electricity for three-fourths of industrial motive power, as well as for 
al. electrochemical processes (arc furnaces, electrolysis, production of syn- 
thetic mitrogen and oil and rubber). Four-fifths of the electricity came from 
central thermal plants. These were highly concentrated: in 1933, 1.4. of the 
chermal slants provided over half the total output, and 5% provided four-fifths 
Sutput. The Allies, however, assumed that despite this inviting concen- 
tration, German grid interconnections provided enough flexibility of routing 
that power stations did not deserve a high priority as bombing targets, and 
indeed this was not done on a large scale until the vast bombing raids of 1944. 
The Nazis were delighted: they felt, and responsible officials including 
s0ering and Speer said afterwards, that systematic targeting of power plants 
would have curtailed the war, perhaps Sv two years, and that they could not 
understand wnhv the Allies had passed up such an efficacious opportunity. Seem 
ingly confirming these German fears, synthetic oil production, which bv eariv 
1944 accounted for over half the German 011 supply, was crippled by selective 
pombing in just a féw months, bringing much of the Nazi war machine to a halt. 
in striking contrast to this centralized vulnerability, Japanese electri- 
sal oroduction in World War I! pid. | was relatively decentralized: 78% came 
from small, highlv dispersed nvdroelectric plants that were not individually 
attractive targets, and the larzest single dam supplied less than 3% of nation- 
al electricitv. The more centralized thermal plants, though they provided oniy 


22; of the total electricity, were so comparatively vulneradle to urban DSombin 
ad > 
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4ams on the Yalu River became a xev tarzet in the Korean war. 4t least since 
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1c of China has reportediv taken 


| 2f the 


military vulnerability to heart in dispersing energy facilities (e.g. most of 
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rural China s electricity comes from several GWe of microhydro sets, often of a 
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1978:495], and small biogas plants provide extensive fuel 
A similar philosophy is reportedly applied, so far 
3S practicaDdle, in Israel--especially after Israeli jets destroved virtually 


yria's oil installations in a half-hour early in the Six Davs' 
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war Decause they were all in ome place. Rhodesia made the same mistake--cen- 
tralized oil depots--and paid for it (p.78) when black nationalist guerrillas 
Dlew one up in December 1978. Likewise, June 1980 opened with a strong attack 
on the SASOL synthetic-fuel plants that provide much of South Africa's liquid 
ruel. Similar attacks have become more common in guerrilla wars since Egyptian 
saboteurs burned British oilfields in Libya in 1956 [de Leon et al. 1978:22]: 
at this writing, guerrillas are said to be closing in on dams and power plants 
im such countries as Chile and Angola. On 14 June 1978, Red Brigades terror- 
ists caused $600,000 worth of damage and blacked out part of the city for sev- 


eral hours with a series of bombs in a power station (Tanner 1978]. Accident 


*) 


r sabotage in a San Juan power plant blacked out Puerto Rico on 10 April 1980, 


shortly after the plant's chief engineer was kidnapped (Anchorage Times 1980; 





at 


New York Times 1980¢]. San Salvador was blacked out 6 February 1981 bv a power- 





plant dombing--the fourth attack on power installations in four days [Atlanta 





Journal & Constitution 1981]; bv 20 March, guerrillas were reportedly surround- 





img a dam providing half £1 Salvador's electricity [Los Angeles Times 1981m]. 





The French military establishment is reported [Caputo 1980:42] to wish to 
reduce vulnerability dv decentralizing the energy system--a desire doubtless 
neightened bv the “impossible” cascading failure of virtually the the entire 
French electric grid on 19 December 1978, with lost production officially esti- 


mated at nearly $l billion [New York Times 1978, 19784; Le Monde 1978, 1978a]. 








Even in the Soviet Unions-where central electrification has been a sacred tenet 
sf tne Communist Party since Lenin declared Communism to consist of ‘tollectives 
Dlus electrification"--there is “reportedly a standing argument between the So- 
viet military and the Politburo....The military argues that decentra!ized ener- 
Zv svstems are of primary importance for civil defense and therefore essential 

to Soviet national security. The Politburo insists on centralization of prima- 


mtrol, and 1s apparentiv prepared 
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must bear the high cost of the extreme reliability required for subwavs and 
2spital operating theaters. A degree of individual matching of reliability 
between source and need can sav a lot of money, as noted in Chapter 3. More- 


Qver, the grid is all-or-nothing: it must be so reliable because its failure is 





$O catastrophic, instantaneously affecting a wide area. If vour o1l furnace 
>reaks down, vou can put on a sweater or go next door, but if the electric grid 
fails, there is no next door: everyone is in the same boat. 

ectrical grids, as Con Ed's experience testifies, can fail catastrophi- 
v. 30 can pipeline grids. Both expose large flows of energy to lasting 
and instantaneous disruption bv single acts, with only limited freedom to re- 
route. 3ut while electrical grids can transmit power (provided it is properly 
synchronized) at levels varving all the way to zero, gas pipelines cannot: the 
pumps fail if gas pressure falls below a certain level. In practice, this 
means that gas grids mst keep input in step with output. If coal barges or 
>il tankers cannot deliver fast enough to keep up with demand, there is simply 
a shortage at the delivery end. But if a gas grid cannot pump fast enough to 
Keep up with demand, it can cease working altogether. In January 1977, calling 
on stored gas and adding grid interconnections was not enough to keep up the 
zrid pressure, so major industrial customers had to be cut off, causing severe 
Sislocations in Ohio and New York. But the alternative would have deen even 
worse, because pressure collapse could not have been confined to the transmis- 
$iOn pipelines. Without abundant high-pressure gas being supplied continuous- 
ly, the gas distribution system too would have been drained below its own crit- 
‘cal pressure. If distribution pressure collapses, pilot lights go out in 
innumerable buildings (including those not currently occupied), requiring a 
veritable army of trained people to go immediately into each one, turn off the 
Zas tO prevent explosions, and later return to restore service and relight the 
Dilots. This occasionally happens on a local level, but has hardly ever 
lappened on a large scale (Paris in 1944 might be an instance). If is such a 
monumental headache that gas companies strive to avoid it at all costs |Kalisch 
1979); indeed, the gas industry generally considers it an abstract problem-- 
much as the electric power industry considered a regional biackout until 1965. 
Yet, ominously, an extortionist threatened a few vears ago to cause a brief 
interruption in Philadelphia's gas supplv--long enough to extinguish the piloe 


ghts, Sut short enough to cause instant and widespread “urban revelopment 


Such vulnerabilitv to large-scale svstem=-wide failure with catastrophic 
>onsequences is cleariv not a desirable feature for anv energy svstem. 5ut it 


' ’ , > 7 
1$ not inevitable: alternative distribution patterns can make such fai iures 








Ohio and New factories and schools were 


Impossibdle. 


apse of grid pressures, 


the 24s 


snortages to prevenct 


hilly rural New England, in striking contrast, was virtual- 


zas use in equally 


unaffected--especially in Vermont, the contiguous state least served dv 


difference was that rural New Englanders had always used 
vstem-wide failures with loss of pumping pressure or 


Not evervone ran out at once, so neighbors 


shortages. 


In previous gas shortages, too, the same overstressed supplies of natural 


zas and of natural gas liquids had caused disruptions in other areas dut not ina 


its decentralized, unsynchronized pattern of gas de- 


northern New England with 


comes from remote sources and that 


liverv and 
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is true that bottled gas 
$s distribution ts liable to disruption; the Ohio River Valley in early 


, rural deliveries on poorly cleared and maintained roads could not always 


-- 


ained even though “extra propane trucks were sought across the Nation” 


Se ma 


and 


‘Every available LPG rail car was purchased or leased" [Congressional 


Research Service 


1977:I1I1:190]. But from the end-users’ point of view, short- 


age 


in one building, and at a fairlv predictable time, is vastlv preferable to 


Capacity is also con- 


Simultaneous area-wide failures without warning. 


sraeli planners: 


s$icgered an important preparedness measure Ddy some 


some 96% of homes had gas 


aitnough there was no gas pipeline service in Israel, 


sottles--whose 


servi 
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independent, highly dispersed storage 


¢: 


sndisruptable. 

he value of independent 
that powered the Chicago gas station, can stand alone art need, 
*peration vy teed not forego the advantages of grid 


and severa) a general strixe shut down much 
citv of Jvv¥skvlda, how- 

somb ined-neat-and-power Scandina- 
disconnect from the grid and keep 
to shut down the 
strike reportediv the power plant 


the resilience 








Nave an academic flavor and are often reminiscent of the single-failure criter- 
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nuclear engineering--the assumption that onlv one 
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analvze; but reactors unfortunately do not read safety reports. The history of 
ures, Like the Con Ed 1977 5 
real reactor accidents, a complex sequence of unforeseen and interactive tech- 
nical and human failures is not only possible but likely. Recovery measures 
gesigned to handle simple, singular failures will not work when many things 
Rave gone wrong and more dominoes are falling every minute. Worse, collapses 
chat were caused deliberately can be expected to exploit, rather than to im 
Dinge randomly upon, those secondary vulnerabilities that can inhibit response 
anc recovery. Some lessons from the Con Ed blackout point up the kinds of 
precautions that can make it possible first to survive, and then to recover 
from, cascading failures. 

secondary consequences of energy supply failures can often be greatly 
nitigated bv even modest advance warning. In the July 1977 New York blackout, 


for example, "Most of the nearly 200 subway trains then on the tracks managed 
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ne nearest stations, thanks to a warning from a quick-witted dis- 


Satcher; still, seven trains carrving | fewer than) 1,000 passengers were stuck 


Detween stations for (several) hours--and the entire svstem folded thereafter 


7:20) Deterioration of power supplies and 





ashing signals enabled dispatchers to order 
trains into stations via a two-way radio system spanning the 230 miles of 
ive action" avoided major strandings; all passengers were 


evacuated within 3-1/2 hours with no reported injuries (Federal Energy Regula- 


cory Commission 1978:55). In contrast, hundreds of rushshour commuters were 


Stuck Setween stations without warninre when a sabotevur switched off vower to 
fe central Stockholm sudDWwav ([Evening Standard 19/9). 





An intriguing and little-known feature of the New York blackout is that 


Dart of a 2o-H2 grid (run chiefly for railways) and most of a direct-current 
grid, soth within the citv, were able to continue oOrmal speration while the 
2V"HS Zrisd crashed, since thev were not dependent om it for synchronization and 
det? eas solated nfortunately, thev served such relatively smal. areas 
chat thev were not 4D.i2 to provide a Sootstrap for S0-H2 recovery operations. 
wOCal 80"°H2 standby generators zeneraliv worked well, maintaining operations at 
~~ iZves irc > Ane 5 734 ~ s$uDD es rom New ,~*@r se in now . Tan Be, tals, , °°. 
and 909 stations, ar biroorts¢ lights were suspended overnizne wever 
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verted, Ddecause odstruction lights on New Yo 
e tramsit worked, though some fuel had to de 
es. Sudwav orficials controlled flooding 

3 compressors | Federal Energy Regulatory 
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rs, and thirteen other estadlisnments, ma 

rs repaired. Con Ed dispatched 13 of it 

e citv to run lifesaving equipment. tad the 
mg plants routinely, as is common in Europe, 
ev would nave achieved higher reliadilitv an 
ter as a virtually free byproduct (Chapter 5 

rgency services (if not domestic tranquili 

open to Con Ed officials facing a darkened c 
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3tiom even more difficulz. For instance, pressurized circuit 

tric heaters mav fail due to gas liquefaction or toss of air 
will occur more rapidly in cold weather, and thev mav not decome 
Dperadle again until hours after the restoration of aux! 


che capacity of stand-bv batteries for operation of critical facilities will de 


dreds of switching operations necessary to excise failed equipment and lost 
.oads and to secure whatever portions of the svstem...remain operable.” (| Econ. 


egulatory Adminis.1981:5-9f] Picking up lost loads in the wrong order, or in 
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excessively large blocks, may further damage equipment. Worst of all, some 


Dower stations have no “black-start™ capabilitv--thev cannot restart in isola- 
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it only if supplied with outside power for auxiliaries or svnchroniza- 
tion or Doth. Some stations which are supposed to have this capability occa- 
Sionally turn out not to. Clearlv, the improvisations that restoration of a 
crashed grid mav require are of such complexity that only people of exceptional 
ability can be expected to do them smooth!v without considerable practice; vet 
Opportunities for that practice are almost nil, and simulation exercises for 


more than routine loca very rare. Utilities are also reluctant to 
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250ut > ps! peak overpressure), and electrical distribution svstems were dadly 
3isrupted, revair was “materially lengthened” dw che rota! loss of vital spare 
parts stores in light sheet-meta! Duildings {Chenoweth er al. 1963:8). Similar- 
-¥, Stephens (|1973:19] notes that a five-mile strerch in the Harvey Canai near 
New Orieans contains am astonishing conmcertration of sil-well service companies 
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3. DISASTERS SAITING TO HAPPEN: SOME SPECIAL CONERGY VULNERABILITIES 

Traditional assessments consider senoarately the safety of energy svstems 

ner trev ar2 lixelv to harm their neignbors) and thejr reliability 

ner tnev ar2 iixelv to stop worxing). The previous cnapter suggests tnat 

Sern energy svstems of large scale, cost, complexitv, and interdcepen- 

, tne .atter is alreadv a serious problem. 3ut the hazards inherent in 

energy facilities are such that loss of their energy supply could 5e the 
Xf sur worries: other side-effects of their failure could de an unparal- 
calamitv. This chapter will examine several case-studies illustrating 

point, and will amplifv earlier remarks about the ease with which certain 

ments can de Ssisrupted, whether accidentally or deliberately. 

Jerendence, Soth for energy supplies and for public safetv, on the inte- 
sf inherentiv hazardous, easilv disrupted energy facilities raises not 

cechnical Sut social questions These have received most arttention in the 

xt of commitments to nuclear power: Weinberg [1973], for example, saw a 

“to examine whether our social visions match our technological inventive- 

ad ’ . ’ ; €Cfe “aA -| , + ~~ . - - --? 

3i:s social visions included “a cadre that, from now on an de counted 
79 prevenec accident, prevent diversion***¥in Uganda as well as in the USA, 
Dia as well as in England”, exercising “great vigilance and the highest 

s of quality control, continuously and indefinitely” [Kneese 1973]. Edsall 
sxepticalliv noted that "People are forgetful, often they are irrespon- 

, eri quite a few of them suffer from deep-seated irrational tendencies fo 
ev and acce.” These tendencies would have to be rigorously pruned 
the copulation of specialists responsible for the vulnerable energy devi- 
they "must 70C take serious mistakes, Secome inattentive or corrupt, dis- 

Sstrictioms, or the like...: their standard of personal conduct must 
r narzed from historical norms fsr the general population...." [Lovins 
@ 19,3:14 Hannes Alfvén [1972] puts it more Sluntlv: “No acts of God 
e permitted.” Maintaining such exacting standards of personal responsi- 
p and orstect ing the technica svstems from people wit Lower standards 
; 
; r? : 7 a societv that nad, for example, overwhelming commercia 
: : Te ras r $0 2 eensions that suld 2zive rise ¢ fanat sm 
Zz + ; 2~>~e@r > - * e°*r714e¢ ' ££ ~ersonrne "hh ece r ac - 
"ts Tav imp am unwelcome degree 0: mogeneitv enforced dv strict s 2) 
s-=3 concern already reflected 19 an extensive professional literature 
Rova “™miss:on on Environmental Pollution 19753 Justice 19°83 Sarton 
.* * 5,7 4 ~*y eo bh on . 
A¥TAS 69D, VTOVOranite 2 F.90d 1.9 95 SteRnartle 1.9 9,. «Us CHE pace O01 
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2 otates was ; mGe ° 
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DroDdlen It arises decause the world is peopled dv human beings rather than dv 
angels and robots. Sshether the resulting failures can be kept smal! enough 
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with the introduction of such technologies and hence make them a source of 
smrest and perhaps a potential victim »f disruption. 
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Sreaxcowns and Suman errors, but in fact deliberate attempts to cause failures 
sav de far sore important. Human intention, which brings technical svstems 

nto being, can also disrupt them. Generallv a much lower technology is needed 
to maxe disorders than order. Whether intention is malicious or reflects mere 
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3.2.2. Ol storage and refineries; zgas processing plants. 
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provide a degree of elasticity to the tightly coupled world oil system. 
nerable: indeed, the Strategic Petroleum 
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from the start been careful to minimize its vulnerability through appropriate 
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ground storage caverns are of course relatively well protected; oniy the sur- 


face installations are of much concern.) That these precautions were not idle 
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thousands of secondary oti terminals are vulnerable to sabotazge (Stephens 1973 
L112], and local oil transportation can become a target--as when Japanese onpos- 
ing Narita Alrport firebombed a train carrving jet fuel to tt (Los Angeles 
Times 198ld]--such tarzets, unlike LNG and L?G cargoes, ar2 unlikely to cause 
more than locally severe damage unless they endanger some larger target, such 
as a refinery, tank farm, or reactor, near the site of attack. Compared to the 


‘* - % . — = =a } : -~ - e io a -~ . : .  - lie - 4 — 
Natura. zas svstem, with 1038 virtuailiv compiete reiiance om pipe.ines anc ics 


imited storage, even the vulnerable 011 system--with its dispersed 
and diverse routes, and with widespread buffer stocks sported throughout the 
local distribution system--seems relatively resistant to disruption 
1. 1967; Grigsby et al. 1968; Boesman et al. 1970]. 

Perhaps compensating for the extra vulnerability of pressure regu 
Zas grids appear to offer better opportunities than oil pipelines for rerout- 
ing. The Congressional Research Service [1:16] remarks that "In the last ten 
years, many additional interconnections have been added, to the point that, ac- 
cording to industry sources, there is hardly a crossing between two pipelines 
without an interconnection that could be used if needed. Compression might or 
might noc be needed at interconnecting points to effect deliveries from a line 
Operating at lower pressure than the receiving line, but in general, the tech- 
nical problems of transferring natural gas within the pipeline network are re- 
porredly not overwhelming. From a practical standpoint, the United States has 
a natural gas pipeline ‘grid’ which could be used to modify the directions and 
quantities of natural gas flows substantially.” How far this would remain true 
if key interconnections or control svstems were disrupted is open to consider- 
able doubt, and Stephens [1979:213] savs the interstate grid is fairly inflex- 
ible anyhow. Nonetheless, processed natural gas, unlike oi! (crude or specific 
' 


4 e " } : . has ry wr ; res 7 “99 ; } , 4 
products), 1s a relatively homogeneous commodity fungidle within the grid. 


os 


recent trend accompanving higher oil and gas prices high 


: 


vulnerability of their grids: the prevalence of theft, ranging from the hi jack- 


lons from Wyoming fields. "Oil thefts have occurred in everv major U.S. port, 
notably in Houston and New Orleans, where tankers at anchor have deen tapped. 


Gasoline nas Seen siphoned out of storaze tanks in New York, Philadelphia and 


‘altimore. Barzes carrving jet fuel, zasoline and heatinz o:1 on the Missis- 
= 3 9°97 2s ‘ } " bs ‘ rim ‘ - ; koe : ‘* = " } . 2 
$ipp! River nave deen robbed. In major refineries in the Southwest, there is 
‘ ¢ . ~- ” -—-— + ne 

evidence that organized crime mav have infiltrated and the FBI has assigned 

— — - ° 7 ** . ? . . ‘ . . .} - . . . 
undercover azénts. The FBI 18s sdikine crude oil shipments with chemicais so 
$f l TT) amen - ' eracead Y* i 19) rh hale - I; . an lage -ar 
$coie so ome cs can oe ao.°\ 2901.2 . re . PUT. e * ane Lec no ~e* . ‘ 


tapping into a pipdine, even a high oressure natural zas pipeline, without 


Causing 4a l2#aK, explosion, or other maior incident revealing (he existence of 


‘ 


the tap, is published and well-known. In 1975, the FPC | Federal Power Commis- 





Sion} reported 130 billion cubic feet of natural zas as unaccounted for, about 
nalf of which was lost during Cransmission This zZas, which was shown on 
meters entering the system, but was neither sold to customers, placed into 
storage, or used in compressors,...{was worth at 1975 prices; 3119 million. aA 
portion of it may well have been stolen.” [Congressional Research Service 
1977:1I1:195] Clearly, people knowledzgeabl2 enough to steal larzge amounts of 


dil and zZas from tankers, pipelines, tanks, etc. are also ad 
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harm to those svstems l 
In short, by increasing its reliance on a highly engineered, inherently 


oe | 
- 


vulnerable oil and gas system designed for a world of infinite Cranqul 


ltv, the 
United States has reached the point where a handful of people in a single nignt 


? 


could stop over 75% of gas supplies to the Eascern U.S. for a vear [Kupperman & 
Trent 1979:73] without ever leaving Louisiana. With a litele more travelling, 
they could cause lasting havoc in the oil system too. This is a function not 
only of where the oil and gas come from--nearly three-fourths of total marketed 


U.S. gas extraction, for example, is in Texas and Louisiana--but also of the 


nature of the processing and distribution technologies, which is an expression 





9f the nature of the fuels themselves. 


It is encouraging that many new oil and gas discoveries are highly dis- 


UN 


persed, especially in traditional importing areas [e.g. Byron 1981; Pennin 
1981], and that this might reduce dependence on long-distance pipelines--a goal 
Stephens recalls was once met with dispersed town-gas plants [1974:80}]. Bur at 
the same time, the proposed massive program of synthetic-fuels development, 
chiefly from Western coal and shale, would add profound new vulnerabilities, as 
the processes not only must deliver their products by long pipelines, but also 
depend on enormous deliveries of water, power, and feedstock, often from far 


away. Supplying 10% of present U.S. oil use would take 90 S2-billion plants, 
0 


>) T 10/ 47 . : 
9,. In 1944, Allied 


using half of all U.S. coal mined in 1978 (Tavlor 1980:3 
bombing around the Ruhr reduced German synfuel output by more than 90% (from 
nearly 100,000 b/d) in a few months, hobbling the Nazi war machine [Energy & 
Defense Project 1980:22-24]. (Earlier, a single raid on 1 August 1943 had 
destroyed 350,000 barrels of oii and half the refining capacity in the Romanian 
ailfields at Ploesti, then a xev German source.) It now appears, as noted 
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above (p. 49), that earlier bombing of other German o11 facilities, especialy 
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those making aviation fuei, would have curtailed world War [I st1i.i sooner 
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of supply or delivery failures, unless elec 





3.3 Central-electric systems 

The vulnerability of oil and zas terminals, srocessing plants, and pipe- 
.imes LS mirrored in central-electric svstems--only worse. Electricity, though 
not tcselr rlammable or explosive, 1s very difriculr and costly to store in 
pulx. While the o1l and zas systems contain at several! stages extensive stor- 
aze providing a “pipeline inventorv"™ of weeks or months, tne electric grid nas 


d-users (untess thev rave orovided 
$a) e = TT ~ 
ntila: expense). Thus, in the event 


tric power can de rapidly 


sudject to the availability of generating and transmission capacity, of switch- 


zear, and of control and communications capabilitv--disruption is instantaneous 


ing synchronization, frequency and phase st 


the tendency of these requirements to compl 


already surveved in Chapter 2 
zous problems of maintaining 011 and gas pu 
time constants of the electric svstem are a 
illiseconds, not minutes 
tion, farflung telecommunications networks, 
cause for concern in oil and gas zgrids--is 


There are also close analogies in vuln 


n 
erability. Chapter 2 note 


urther complications--the great complexity of maintain- 


ability, and voltage stability, and 


icate restoration after failureé--were 


, and are markedly less tractable than che analo- 


rity and distribution pressure. The 
lso far shorter: control response is 


or hours. Reliance on computeriza- 


and specialized skills--already 


eve 


Ww 
. 


greater in electric grid 
d that many 


Key components cf eiectrica!l svstems, ranging from turbdoalternators to main 


transformers, are special-order items with 

stations and transmission lines has many fe 
ines and pumping stations. Just as refine 
cooling water, pump lubricants, etc., so do 
The analogies continue even to certain deta 
have a risk of explosion from hydrogen used 
into light products, so dig electrical zene 
drogen (whose small molecules reduce fricti 
ures are so much more immediate and dramati 
supply, and offer so “ew options of subsctit 
use devices, electrical zrids and their com 
ly sabotaged than oil and gas zgrids. This 

; , , 


Materia. in Cnapter <, wi.ii further examine 


.ed the Comptroller-General (198laj) to find 


sould Slack out a typical region, and thae 


long delivery times. Repair of subd- 
atures in common with repair of pipe- 
ries depend on continuous supplies of 
many costly electrical components. 
ils: just as refineries, for example, 
to hydrogenate carbdon-rich molecules 
rators too are often cooled with hy- 
on). 
¢ than interruptions of oil or gas 
ution in the highlv specialized end- 


ponents seem to be far more frequent- 








% 2 ™ Mecuiak 

3.3.i. Power stations. 
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tomes from about 1200 nvdroelectric dams, of wnich about 360 exceed 25 Mae. 


decades. Most dams and their turbines ‘though not their switch 


,ccr .s = } . 7 > >see : = 2Pge@el117b: ) = 3 - law 
mission iines) are relatively resistant to interference luckily since ce 


eee 


struction of a dam often carries a risk of serious flooding. About 1% of naa- 


tional installed generating capacity is itn nearly a thousand diesel engines, 
mainly in rural areas and small peaking plants. Another 8% of the capacity is 
in about 1200 gas turbines, run on average only 7% of the time; their high fuel 
cost and low thermal efficiency restricts them to peaking use. Abour 0.1% is 
in geothermal and wind capacity. The remaining plants--about 78% of installed 
capacity, supplying about 82% of the kilowatt-hours--are the 900-odd major 
"thermal" (steam-raising) plants, operating on average at just under half their 
full-time, full-power capacity, and generating in 1979 about 55% of their out- 
put from coal, 15% from oil, 17% from natural gas, and 13% from uranium. (Since 
then the oi! Surn-has fallen dramatically, from about 1.7 Mb/d nearly to 1 Mb/d 
in 1981, heading for 0.8 Mb/d or so by the end of 1982 [Taylor 1980a]. The main 
substitutes for oil nave been coal and efficiency improvements.) These statis=- 
tics do not include self-generation of electricity in factories. This "cogen- 
eration" as a byproduct of process heat or steam, using combined-cycle steam 
turbines, diesels, or gas turbines, probably provides electricity equivalent to 
at least 5% of the electricity generated for the grid, and is often independent 


of grid operation, providing its proprietors with greater "insurance" (p. 52). 
The large thermal plants supplying over four-fifths of U.S. grid electri- 
city deserve special attention here, not only because of their centralization 
and dominance, but also because they need continuous provision of fuel, cool- 
ing water, outlets for their electricity and effluents, and control and commun- 
ications systems. Interruption of any one of these will shut down the plane. 
(On-site fuel stocks, however, can provide a buffer of davs to weeks for dual- 


fuel gas-fired plants holding oil stockpiles, ome or two months for oil-fired 


plants, three months or more for coal, and one or more yvears for nuclear. 


Ww 


ingle-fuelled gas-fired plants, common in such regions as Texas (whose grid :s 
not interconnected with the rest of the countrv!, carry almost no stocks: Goen 


et al. [1970:75!] found that San Francisco's entire gas storage capacity would 
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last one local gas-fired power plant for only 14 hours.) Power piants comp.iex, 


. 


f is of course also vulnerable to disruption, 


special-purpose machinery ifse 




















even by low-techno 
yet so delicate, that when not spinning they must have their shafts rotated a 


fraction of a turn several times per hour, by hand if necessarv, lest their own 


weight ruin them by bending the shaft out of true. On occasion, such as during 


the Three Mile Island accident, this service has deen difficu 
the face of evacuation requirements. 

The vulnerability of cenrral thermal power stations is not a new issue. 

In 1966, the Defense Electric Power Administration [1966:13A] pointed out that 
"fewer than 200 cities and towns of over 50,000 population contain about 60% of 
the population and associated industrial capacity of the nation. The larger 
generating facilities tend to be located near[by]....Generating capacity is the 
most difficult, costly, and time consuming component of an electric power 
System to replace and also tends to be highly concentrated geographically. If 
any portion of the power system is to be considered a primary [strategic] 
target, it would be these large generating plants....Is the concentration of 
power generation making the industry more vulnerable....?" 

In the intervening 15 years, the question has been often repeated, vet the 
concentration has increased, with major power plants being drawn to conurDda- 
tions and probably encouraging urbanization and industrial concentration in 
their turn. "Although there are about 3,500 companies involved in generating 
and distributing electricity, about half of our total electrical capacity comes 
from fewer than 300 generating stations. Most of these are located in or near 
Our Major urban-industrial areas. The electric utilities therefore present a 
relatively compact and especially inviting set of targets for a saboteur, a 
terrorist or an attacker, as well as a lightning bolt." [Joint Committee on 
Defense Production 1977a:1] Though this concentration is less than that of 
some other sectors--pipelines, large refineries, smelters, etc. [Goen et al. 


1970:71]--it is also uniquely true of power stations that the loss of substan- 





tial generation or transmission capacity can crash the whole grid, shutting 
down undamaged plants that are inadequate to maintain system frequency. The 
Research Director of the American Public Power Association was recently moved 
by these trends to remark [Holmberg 1981] that "there is considerable evidence 
that one of our highest national defense priorities should be to insure the 
continuity and productivity of the United States through aggressive support of 
" 


decentralized energy supply. Confirming this, attacks on power stations have 


become almost a routine feature of guerrilla campaigns, ranging from italy and 
Puerto Rico (as noted in Chapter 2.2.2) to Cyprus (1955), Britain (1969, dy 
, Eire (1974), Chile, 


internal sabotage at Aberthaw and perhaps Fiddler's 


and El Salvador. After a California plant dombing, ome power engineer told us 
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that the company had escaped with minor damage only by the saboteurs’ lucky 
choice of the strongest point on the strongest station: 2lectric plants, he 


said, are “terribly vulnerable. Someone who knew anvthing at all could cause 


terrible havoc.” Other targets could easily have been “blown over.’ 


3.3.2. Electrical transmission. 


High-voltage transmission lines carry an astonishing amount of energy, 
second only to large pipelines. A 500-kV line typically handles about 2 Gwe, 
the output of two giant power stations [Congressional Research Service 1977:1: 
357]; a 765-kV line, about 3 Gwe. In some areas, such as New York City and 
South Florida [Joint Committee on Defense Production 1977a:7-8], geography 
squeezes supposedly independent transmission lines into a single narrow corri- 
dor. In others, remotely sited plants, perhaps at a Western coal-mine, send 
their lines over hundreds of miles of remote countryside. No transmission line 
can function without switchgear and controls at each end: the entire New York- 
New England power pool, for example, is controlled from a single center near 
Schenectady [Joint Committee on Defense Production 1977:I11:36]. Broadly speak- 
ing, the contiguous U.S. grid is interconnected within each of three largely 
separate regions [Congressional Research Service 1977:1:365]--Texas, eastern, 
and western, with the demarcation running roughly through Nebraska--but inter- 
change between the constituent pools of each region is heavily dependent* on 
particular transmission segments, such as the 7-GWe Wisconsin-Missouri-[llinois 
intertie [Mertz 1977], as well as on the pool and utility control centers and 
communication systems and on uniquely vulnerable extra-high-voltage switchgear 
and transformers [Kupperman & Trent 71-72,106]. Despite their kev role in 
interstate commerce, transmission lines are in general not protected by Federal 
law [Joint Committee on Defense Production 1977a:8]. 

Transmission Lines have often been sabotaged. Examples cited by the Energy 
& Defense Project [1980:16] include New Jersey 1978, Colorado (lines feeding a 
military plant) 1969, and California 1975. Fourteen towers in Oregon were 
bombed, and at least six toppled, in 1974 bv an extortionist threatening a 
Portiand "blackout"; pipe bombs caused minor damage at six California towers 
im one night in 1975 [GAO 1978:II:App. IX]. Other attacks include Alabama 
1966, Ohio (blacking out parts of Cincinnati) and Louisiana 1907, Wisconsin 
1968, and California and Washington 1973 (Flood, versonal communication]. In 
the bitter confrontation mentioned in Chapter 2.1.3, conservative, fiercely 


_* 
/ 


independent Minnesota farmers during 1979-80 caused $/ million in damage fo en 


800-kVDC line. Nocturnal “bolt weevils,” havirg perfected a low-technology 





*For examples, see 


if. " -~ ee ** - . : ~~ 2 | > hi . » ‘ . } = 7 ’ 
\Economic Regulatory Adminiscration 1979:°12:181-216). 
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technique requiring only a few people and hand tools, have toppled 14 towers, 


and an outbreak of “insulator disease," commonly ascribed to rifles (or even to 
Sophisticated slingshots), has littered the ground with the remains of over 
3,000 fragile glass insulators. The epidemic attacked 350 insulators per week 
in early 1979--sometimes more than that in a single night [Casper & Wellstone 
1981:283,285]. The 1.5" aluminum wires themselves proved vulnerable to rifle 
fire {id.:277]. Guarding just the Minnesota section of line--176 miles with 
685 towers, often through farmers’ fields far from public roads--is still, arc 
this writing, proving an impossible task. Despite high-speed helicopters, a 
$100,000 reward, 300 private guards, and extensive FBI activitv, not one of the 
perpetators has been caught. [It is no more likely that they will be, given the 
depth of their local support, than that South Africa will discover who has, as 


we write this, cut its power lines from the Cabora Bassa dam in Mozambique, 


threatening South Africa with "selective power cuts" [Los Angeles Times 198le], 





and blacked out Durban by blowing up a substation [id.:1981lz]. No wonder an 
Interior Department expert confirmed that "a relatively small group of dedicat- 
ed, knowledgeable individuals...could bring down [the power grid supplying] 
almost any section of the country,” or "a widespread network" if organized on a 
somewhat broader scale [Joint Committee on Defense Production 1977a:87}. 

Even without interference, transmission lines are vulnerable enough. Of 
the twelve worst interruptions in U.S. bulk power supply during 1974-79, six 
were caused by failures in transmission, six in distribution, and none in gen- 
eration. Seven were initiated by bad weather, four by component failures, and 
one by operator error. [Economic Regulatory Administration 1981:4-4] Among all 
reported interruptions during 1970-79, however, "75% have been due to probtems 
related to facilities, maintenance, or operation and coordination. Only 25% 
have been initiated by weather or other forces external to the utility" lid.: 
4-5]. Whatever the causes, failures are rife. On 5 April 1979, a buildup of 
dust and salt sprav on 240-kV insulators caused arc-over, leaving no outlet for 


three generating stations and blacking out the Miami area and much of Fort 


Lauderdale and West Palm Beach [International Herald Tribune L979}q The Québec 





transmission grid averages about three major failures per vear, chiefly in cold 
spells which (owing to the intensive promotion of electric heating) coincide 
with peak demand. In the chillv first week of Januarv 1981, both Hydro-Québec 
and Ontario Hydro met record peak loads only by importing power: the former 
had lost nearly 2 GWe through transformer failure at the James Bay hydro site, 
and the latter, about 1.5 Gwe through emergency shutdowns at two nuclear plants 
and a coal plant [Claridge 1981]. On 8 January 1981, a sudden power failure, 


apparently due to a quadruple transmission failure, blacked out all of Utah and 
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parts of Idaho and Wvoming for 3-6.5 hours--some 1.5 million people in all [New 





York Times 1981]. On 24 September 1980, most of Montana was blacked our for 





about an hour, prompting editorial comment on the vulnerability of "Society's 


electric heartbeat" [Great Falls Tribune 1980]. Both these regions are of 





special interest because they are officially planned to become--via coal mines, 
coal slurry pipelines, and synfuel plants, all of which are extremely dependent 
on reliable electric supplies--a main source of domestic fuel to replace 
Mideast oil. In various parts of tie country, transmission lines have been 
interrupted by aircraft accidents (a National Guard helicopter crashing into a 
161-kV TVA line in 1976), explosions, equipment faults, broken shield wires 
(which run from the apex of one tower to the next), and even kite flying [Clapp 
1978:41]. Southern California Edison Company has experienced extensive damage 
to 16-kV and smaller wooden-poled lines (though little to >22-kV lines on 

steel towers) through forest fires; and on occasion, the fierv heat has ionized 


the air sufficiently to short out conductors [Chenoweth et al. 1963:34]. 
3.3.3. Substations and distribution networks. 


Transmission is usually considered to involve lines carrying at least 
69,000 volts (69 kV), and bulk power transmision, over 230 kV [Congressional 
Research Service 1977:1:349]. "Main transmission lines are extremely difficult 
to protect against sabotage as they are widespread over each state and traverse 
remote rugged and unsettled areas for thousands of miles. While these facili- 
ties are periodically patrolled, ample time is available for a saboteur to work 
unobserved. It may be comparatively easy to damage this part of a system, but 
it is readily repaired. Damage to remote controlled or automatic substation 
@quipment could make repairs and operation more difficult." (Defense Electric 
Power Administration 1962:25-26] The analogy with pipelines is clear enough: 
the line, save in especially awkward locations, is far quicker to repair than 
its interchanges and operational systems (pumping stations for pipelines, sub- 
stations for electric transmission). A principal point of vulnerability, 
albeit one seldom capable of blacking out more than a relatively local area, 
is the substation which transforms transmission to lower voltages for distri- 
bution over subtransmission lines and over 4 million pole-miles of retail 
distribution Lines [Defense Zlectric Power Administration 1969]. Although DEPA 
[1962:26] considers that damage to substations and distribution networks “would 


have such a sfighe effect on the overall system as to make this tvpe of 


ON ; 
sabotage unlikelt\', many saboteurs evidently do not see it that way. There are 
~ 
» . . . , ’ . 
over four times as manv substations rated over 10 MVA as there are central 























power stations [Goen et al. 1970:79], so near virtually any load center there 





is a corresponding sudDstation--an effective target for hizhly selective dlack- 
outCS OF a convenient one for symbolic damage. 30th Cransmission sudstations 


\Serving mainly Large industrial customers at subtransmi 
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distriducCion substations (serving mainly residential and commercial customers) 
nave Deen attacked Dy many means. In 1975 and 1977, the same Pacific Gas & 
ectric Co. sudstation was damaged Dy pipe bombs, interrupting tens of thous- 
ds of customers [Joint Committee on Defense Production 1977a:61]. Four other 
PG&E substation dDomings caused local blackouts in 1977, and a transformer >»omb 
g blacked out eastern Puerto Rico in 1975 [Energy & Defense Projece 1980:16]. 
Additional substation and transformer bombings occurred in California and Seat- 
tle 1975, Colorado (causing $250,000 damage) in 1974, Albuquerque ia 1977, and 
two California sites in 1977 [GAO 1978:II:App.IX]. During 1974-77, the FBI re- 
ported a total of 10,919 actual or attempted bombings in the U.S., of which 824 
(3273 explosive and 3686 incendiary) were successful. Although public utilities 
represented only 1.9% of the total targets in 1975-76, they did suffer 53 delib- 
erate explosions in that period--about one every two weeks [id.]. In some in- 
stances, such as the Oregon transmission-lLine bombings in 1974, the campaign was 
sO concerted that a massive investigation and manhunt were deemed necessary 
[Congressional Research Service 1977:111:159]. To complicate matters, utility 
transformers often contain cooling oil that can be reieased and ignited by 
standoff methods, including rifle fire; the oil may contain highly toxic PCBs, 
which greatly complicate repairs; and hard-to-trace disruption can be caused 
simply by using the substation’s controls without damaging them. (A novel 
[Chastain 1979] describes a fictional extortionist who caused blackouts in New 
York City by throwing under-street transformer switches.) Con Ed's Indian Point 
substation even caused a blackout 19 July 1977 when it blew up all by itseif; a 
Similar incident on 12 July 198i--one of three Con Ed substation fires in five 
dJays--dlacked out 39,000 customers [Gargan 1981]. A recent failure at a single 
09-kV transformer blew it up, ignited 3000 gallons of cooling oil, and halted 
the supply via 13 underground cables to two substations, blacking out for four 
hours 6% of Con Ed's load--much of lower Manhattan, including one of the 
world's densest concentrations of financial computers [Kihss 1981,198la]. 

To the end-user, it matters little whether a power interruption is in the 
bulk supply--which accounts for only about 15% of the total--or in distridution 
(the other 85%) [Economic Regulatory Administration 1981:4-10]. The roughiy 
365,000 circuit miles of overhead transmission (id. :2-9] and its switchgear and 
control systems are a tempting target for widespread disruption; but for local 
dr selective disruption, sadDotage of distribution is at least as eacv to arrange 
and at least as hard to repair, with the added bonus that alternative cistribdu- 
tion (unlike transmission) routes are often not available unless the utility 
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nappens to have suitable mobile equipment that can de :spliced in temporari.y. 
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3.3.4. Control and communications. 


No part of the synchronous electric grid can function without continuous 


cOmmunications from such centralized, computerized control points as utility and 


vu 


Ool dispatchers to each other and to the field. The vulnerability of field 
Nardware to nuclear attack [Chenoweth ert al. 1963; Lambert 1976] pales deside 
comtrol vulnerability to the lO-nsec-risetime electromagnetic pulse (EW?)-- 
peaking at 50 kV/m and 6 Mw/m- (6900« the power density of peak sunlignt) 
-~produced Dy a 1-MT high-altitude thermonuclear Durst over a radius of 300 km 


or more [Lerner 1981:42]. Thus one blast nigh over the central U.S. would 


-- 


blankec all lower +8 States with a pulse of at least 25 kV/m [King ec al. 1980) 


--ample to cause an instantaneous common-mode failure of unhardened electrical 





and electronic systems, including electric-grid and pipeline controls, tele- 
phones, and other telecommunications except fiber optics. Most grid controls 
would be damaged functionally (burned-out transistors) or operationally (erased 
computer memory) [Lambert 1976:51; Lerner 1981:42f£]: integrated circuits are 
about ten million times as prone to EMP burnout as vacuum tubes [Broad 1981). 
Since power lines act as antennas to collect the pulse, and its risetime--a 
hundred times faster than lightning--is too fast to be stopped by most lightning 
arrestors, many end-use devices would probably be burned out. Such non-controi 
devices as transformer windings and transmission-Line insulation could also de 
damaged by peak induced surges as high as 30 GW [Lerner 1981:42f£]. Nuclear 
reactor safety systems may be disabled [Energy & Defense Project 1980:305], per- 
haps causing an epidemic of meltdowns [Lerner 198la]. Design trends in the 
power industry are Lending to increase the likelihood of EMP damage (Nelson 
1971), and “the extreme difficulty and expense of protecting the grids has 
discouraged utilities from taking virtually any action" [Lerner 1981:46]. 

The power grid's control and communication are vulnerable to commoner haz- 
ards than EMP. “Because of their vital role in system reliability, the computer 
facilities in control centers are usually doubly redundant (backed up Dy a com 
plete set of duplicate facilities); in at least one center they are ‘riply re- 
dundant. Their power supplies are ‘uninterruptable' and are also often doubly 
redundant." (Econ. Regul. Admin. 1981:2-8]. Yet a pocket magnet, as Stephens 
points out, can give a computer amresia. Grids’ ability to reroute power (Lam 
bert & Minor 1975); assumes the perfect operability of control systems. Control 
centers, furthermore, Tust communicate with each other and with field equipment 
(generators, switches, relays, etc.); otherwise no rerouting or Load alterations 
are possible. This communication relies on telex, telephone, signals sent over 
the power lines themselves, radio, and orivate microwave circuits. Despite 
Dattery and standby-generator power supplies, all these links are vulnerable to 


disruption. With microwaves, for exampie, the loss of one Sase or repeating 


A 





station can easily make a large portion of the communication svstem inoperable” 
[Defense Electric Power Administration 1962:31]. Mest utility operations can 
probablv be disrupted far more easily dv attacks on tueir communication systems 
than on generation, transmission, or distribution components. Without instant 
communication, or at least an army of experts in the field manually operatin 
the system according to prompt radio instructions, the stability of the grid 
will be in danger. Few utilities have installed reliable underfrequency relays 
to ensure that if control and synchronicity are lost, their gric will automati- 
cally isolate itself into small islands, maintaining service where possibdle and 
at least preventing serious damage to major components. 

Another disturbing possibility, to which no attention appears to have been 
given, is that rather than merely cutting communications, 2a saboteur zight-- 
like 4 phone phreak--prefer to use them. Indeed, both private and public tele- 
phone lines can be tapped into remorely, as noted in Chapter 1.2.4, and many 
utilities’ control computers--not merely their accounting computers--appear to 
be accessible to phone phreaks. Such codes as are normally used are easily 
dSroken by the phreaks’ microcomputers. Worse still, despite the encrvption 
used on some utility microwave networks, it is probably well within many elec- 
tronic enthusiasts’ capabilities to tap into a utility microwave net using a 
portable dish and effectively to take over the grid. 

One utility control expert with whom we discussed these concepts felt that 
the diversity of communictions links which his company uses, and certain tech- 
nical features of its microwave and other systems, would make takeover diffi- 
cult: most likely the company's operators could still maintain control. But ‘\e 
agreed that this result, if true, was not by design but bv accident--a result 
of precautions taken against natural disaster--and that companies less sophis- 
ticated than his own (perhaps the best-prepared in the country in this regard) 
might weil be worse off. That particular grid is designed to be manually 
Operable from dispersed control centers, but it is not hard to envisage ways in 
which communications between them could be blocked or spoofed, and the grid 
perturbed, in wavs beyond the abilitv of manual control to handle. For most if 
not all electric utilities, elementarv consideration of the published details 
2f communication systems suggest that the vulnerabilities commonly discussed-- 
such as the risk 9f sabotage to switchyards, transmission lines, and power 
plants--are just the tip of the iceberg. Analogous considerations apply to the 
control and communications systems of oi11 and gas pipelines. 

In summary, whether dv brute-force sabotage of a kev switching or trans- 


mission facility or of one of the operational Lifelines (such as cooling water 


, 
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9f fuel transportation) of one or more giant power plants, or instead 5v an 
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e.egantiv economica. 3isruption ofr contro. and commur:ications svst2ms, 4 smaii 


group of people--perhaps one able person in some circumstances-~-could Slack ou 


practically anv city or region. With careful selection of targets and of their 


most vulnerabie times (peak loads, options limited by preexisting outages, 
unfavorable weather for repair, etc.), it should not be beyond the ability of 


some technically astute groups to black out most or all of anv of Amer 


o~ 
ae) 
be 
se 


three synchrorous grid regions. These dSlackouts can de engineerec in such a 
way as to cause sudstantial damage to major items of equipment, probably re- 
quiring months or years to repair. If is conceivable that similar SreakJowns 
could arise from a combination of natural disasters, imperfect utility re- 
sponse, and incomplete understanding of the operational dynamics of big grids. 
However caused, a massive power-grid failure would be slow and difficult to 
restore, would gravely endanger national security, and would leave lasting 


economic and political scars. 


3.4. Nuclear fission svstems. 





Nuclear power reactors*® suffer from the vulnerabilities already described 
for central-electric svstems. This section explores the following additional, 
uniquely nuclear vulnerabilities of reactors and their ancillary plants: 

- their enormous radioactive inventories, which may be a focus for civil 

concern and unrest [Ramberg 1978], an instrument of coercion [Norton 
1979), and a cause of devastation if released bv sabotage or war; 
- their unusual concentration of interdependert, exotic resources; and 


- their facilitation of the manufacture of nuclear bombs. 





*For simplicitv, this treatment will consider onlv fission reactors, not 
potential future fusion reactors (which would have analogous Sut milder safety 
and waste problems and several significant safeguards problems.) Power reac- 
tors will be assumed here to mean those commonly used in the U.S.--light-water 
reactors (LWRs)--rather than other thermal-neutron reactors such as CANDU or 
fast-neutron reactors such as the proposed liquid-metal fast breeder. For the 


purposes of this discussion, these design distinctions do not give rise to 


’ 
‘ 
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important differences of principle. Our conclusions do not depend on differen- 


ces between once=-through and reprocessing fuel cvcles, and although the former 
i¢ likely to remain the U.S. commercial practice, we Srieflv consider the 
potential for major radioactive releases from reprocessing piants. 

The likelihood of releases from sabotage of large power reactors mav Se 


similar, and the consequences roughly equivalent, in the case of numerous smal) 


teaching and research reactors, since thev are often in the middle of large 

cities, take few or no security precautions, and have no containment duildinres 
For simplicity, these small reactors will not be describec further here, Sut 
,* 


complete analysis would nave to consider them more fullv. <A tore comprehensive 
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and documented treatment of technical issues raised in this discussion <4n de 
also [Ford 1961)! 


found in [Lovins & Price 1975; Lovins & Lovins 1980!3; see als , 
We ignore here certain Federal nuclear faciiities, damage to which could 
have serious national-security consequences [EAL 1980:1:2-10¢ 


, 











This analvsis concentrates on the first of these three vulnerabilities, 


and especially the extent to which nuclear facilities can provide an attractive 


ry 


arget for sabotage or acts of war. The targe !iteratur2 on major hypothetical 


releases of radioactivity deals a 
which are often claimed to be very improbable. That analysis tends to ignore 
Intentional releases, although it 1s common ground that the consequences of a 
major release dv either cause-could be unprecedentedly grave. The 2tomic 
Energy Commission's Direcror of Regulation agreed [Dve 1973], for example, char 
a dand of highly trained, sophisticated terrorists could conceivably destrov a 
near-urdan reactor so as to cause thousands, perhaps even millions, of deaths. 
More recently, his NRC successor agreed [Subcommittee on Energy & the Environ- 
ment 1977:8] that “thousands of lives and billions of dollars” could be lost. 
Secause these consequences are so great, it is important to establish whether 
nuclear terrorism and sabotage are plausible, what sorts of people and weapons 
might be devoted to that end, and what technical vulnerabilities of nuclear 
plants might be exploitable. We shall therefore consider these subjects in 
turn before returning to examine in more detail the consequences--radiclogical, 
social, and economic--of such acts. This section will conclude with a brief 


survey of the special problems of illicit nuclear bombs. 
3.4.1. Nuclear terrorism: intentions and incidents. 


Whether nuclear terrorism is plausible is best inferred, not only from a 
study of the technical potential for it, but from what terrorists have said and 
done. Low-level attacks on nuclear facilities have in fact become so common, 
ard the level of violence is esctiating so steadilv [Bass et al. 1980:77], that 
1f seems onlv a matter of time before major attacks are successfully attempted. 

International terrorists are directly reported to be showing an increasing 
interest in nuclear matters. <A Europe-wide NATO alert shortiv after the assas- 
sination of Aldo Moro “was prompted by an explicit warning from the West German 
state security officials of possible terrorist plans for atomic blackmail: 
raias on nuclear bomb depots, kidnapping of specialized NATO officers, hijacked 
Taw materials, occupation of nuclear plants, to name a few possidilities in 


what the Red Brigades speak of as ‘a growing sensitization to international 
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securitv obiectives. terling 19/783:38'. 


~*~ + «= 


In a clandestine interview with Stern (Kellen 1979:61-62), defected Cernan 


* e S a ‘ e 
-@rrorist Michae. Saumann stated, “I do not want to suggest that some group, at 


this time (1973), has concrete slans or even definite plans | for auc'ear extor=- 


tion]....3ut nevertheless, this is in the spirit of the times” and has deen 
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ciscussec among Cerrorists. aS governments iiarcen tneir no-concessions osoilcy 
against terrorism, terrorists are ariven 


r sure, and wnat e:se can tnat 5 
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nuclear power station? aA. i 
have vast amounts of money. They also can build ap 
But an attack on a storage depot is more likeiy. Af 
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the killings ix 
ebach, the Americans noted that in a barracks 16 nalr-forgotten auclear 
warheads were stored. Only a . 2w German guards were there with their 
police dogs. Q. And how would the...terrorists proceed in the course or 


a nuclear action? aA. Theat is, initially, completely without importance. 

j no ji something like that {nuclear weapons] in hand has enough 
power to make the Prime Minister dance on a table in front of aT.V. 
camera. And a tew other statesmen alongside with him. That is an [.0.U. 
or ultimate power. 


while Baumann's statements are somewhat speculative and cannot be taken as a 
definitive indication of the intentions of today's hard-core terrcrists, thev 
are nonetheless a useful starting-point for further inquiry. 

More indirect motives might also be important [Bass et al. 1980:6]: 


Given that leftist radicals see nuclear programs as symbols of a corrupt, 
miltarist, capitalist state, they may attempt violent actions against 
muclear targets as a way to rally opponents of civilian or nuclear nucle- 
ar programs to their cause. European terrorist groups clearly have iden- 
tified the antinuclear movement as a source of possible supporters and 
have carried out actions calculated to appeal to the more extreme members 
of that movement [who would, however, be rejected by their colleagues, the 
overwhelming majority of whom adhere to the principles of nonviolence].... 
(I]t has been reported that in Italy a Red Brigades document urged attacks 


on nuclear power plants to exploit antinuciear sentimenc in the country. 

Has this interest actually been manifested in overt acts of sabotage and 
terrorism against nuclear facilities? Unfortunately, the list of such inci- 
dents is already long and is growing rapidly. The perpetrators seem no longer 
ted individual saboteurs and local semi-amateur groups, 
reasingly to include more organized and sophisticated international 
zroups with access to a woridwide network of resources. in two instances, an 
traqi ‘research reactor has been overtly attacked by government aircraft as 


an act of war, the second time deing destroved. But iower-level, clandestine 





ist of published incidents (plus the other 


examples postponed to iater sections) give the flavor of the diversity and the 





gradually escaiating intensity and tocus of nuclear terrorism to date inci 
dents not specificaliv documented are zenerally given in Flood'’s compeniium [1976]. 
- Armed attac«s and dombd expiosions the Atuchael reactor in Argentina, 
when nearly Duilt in 19/3, was taken over Dy 15 armed guerrillas for publicity. 
They quickly overpowered five armed guards, caused only .ight damage, and 
wounded two other guards whom they encountered while withdrawing (Burnham 1975 
32). The Trotan reactor in Uregon has had its Visitor Center bombed | Kupperman 














Trent 1979:36!]. The Fessenheim reactors in France sustained peripheral site 
damage bv fire after a 3 May 1975 bombing. On 6 June 1975, half the input ter- 
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minals at the computer center of Framatome (the French reactor vendor) were 


3 


destroved Dy a carefully placed bomb, and another damaged valve testing shops 


D 
in Framatome workshops. Two bombs set by Breton separatists on 15 August 1975 
Caused minor damage to a cooling-water iniet and an air vent at the operating 
Zas-cooled reactor at Monts d'Arée, Brittany, which was closed for investiga- 
tion; it was the eighth sabotage attempt in a month by the separatists against 
utility installations, and the most spectacular, using a boat that crossed the 
artificial cooling lake through cut fencing. In early November 1976, a bomb 
caused extensive damage at the Paris offices of a nuclear fuel manufacturer, 
and two more put a French uranium mine out of operation for about two months by 
destroving four pump compressors [de Leon et al. 1978:29]. In March 1978, 
Basque separatists bombed the steam generator of the Lemoniz reactor, under 
construction near Bilbao in northern Spain, killing two workers, injuring 14, 
and causing heavy damage [Bass et al. 1980:11], as part of ten simultaneous 
attacks on scattered facilities of the plant's construction company, Iberduero 


(Times 1978]. By 1981, the project was under siege [International Herald Tri- 





bune 1981]: its chief engineer (like the manager in 1978) had been kidnapped*, 
Iberduero had been bombed again (killing the fourth bomb victim in three years’ 
attacks), and more than a dozen bomb attacks on Leminoz and Iberduero had oc- 
curred in January 1981 alone. "There have been armed assaults on nuclear faci- 
lities in Spain, and aruwed terrorists recently broke into a nuclear facility in 
Italv." [Be et al. 1980:74] Unknown saboteurs skillfully blew up the nearly 
completed core structures of two Iraqi "research" reactors at a French factory 
on § April 1979. Electronic controls at the Stanford Linear Accelerator were 
heavily damaged by two bombs in 1971. Reactor guards at several U.S. sites 
have been fired upon [e.g. Subcommittee on Energy & the Environment 1977a:247]. 
On the 1976 Memorial Day weekend, the USNRC issued a security alert to U.S. 
nuclear plants on the basis of "highly tentative and inconclusive information” 


the nature of which has not been disclosed [Los Angeles Times 1976]. Unexploded 





bombs have been found at the Ringhals reactor in Sweden [de Leon et al. 1978: 
29], the Point Beach reactor in Wisconsin in 1970, and the Illinois Institute 
of Technology reactor in 1969. In 1975-76, a person “was srrested for attempt- 


ing to illegally obtain explosives to use in sabotaging a [U.S.] nuclear power- 
" f : e* ~ - . 8 o ° . 

plant’ (Comptroller General of the U.S. 1977:2]. The chief scientist of the 

Iraqi nuclear program was recently assassinated in Paris (as was a probable wit- 

ness), allegedly by Israeli agents [Marshall 1980a]. "Terrorists in Spain have 


kidnapped officials of nuclear facilities for the purpose of interrogating them 
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tHe was later killed [Toth 1981). 
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and taking their keys to place bombs in their offices. The same [ Basque] 
terrorist group has threatened prominent officials in the nuclear industry with 
assassination if planned nuclear programs were pursued. Terrorists in west 
Germany have placed bombs at the homes of those charged with the security of 


[Bass et al. 1980:74]} 


nuclear facilities. 


- Insider sabotage. A 1971 fire doing $5-10 million damage to the Indian 





Point 2 reactor in New York was set in an auxiliary building (housing control 
panels, cables, and pumps) while Unit 2 was fueled but not yet critical and 
Unit 1 was operating nearby. The arsonist turned out to be a mechanic ar 
Maintenance man at the plant, had worked for Con Ed for seven years, was an 
Army veteran, was married with three children, had long lived in the area, 
turned in the alarm himself, and was among the first to fight the fire [Bass et 
al. 1980:40]. "A series of suspicious fires between June and November 1977 
delayed the completion of Brazil's first nuclear power plant at Angra dos 
Reis." [id.] Worker sabotage has been reported at Zion in Illinois in 1974 
[Emshwiller 1980a], at the Fort St. Vrain high-temperature gas-cooled reactor 
in Colorado, at the Trojan reactor during its construction in Oregon in 1974, 
at Browns Ferry in Alabama in 1980 (reportediy including the disabling of 
closed-circuit TV cameras) [id.], and in Switzerland [Bass et al. 1980:74]. 
During a 1973 strike against Florida Power & Light Company, there were 101 
incidents of sabotage damaging equipment offsite, and the FBI was alerted to a 
rumored plan to sabotage the main generator at the Turkey Point nuclear plant. 
Suspected arson has occurred at Knolls Atomic Power Laboratory (General Elec- 
tric, New York), at several other U.S. nuclear research facilities, and in 1975 
im an equipment storage barn at the West Valley (New York) reprocessing plant. 
The Winfrith, Wylfa, and Berkeley reactors in Britain have been damaged by 
sabotage during construction or operation--Winfrith by pouring a mercury com- 
pound into the calandria, where it amalgamated with the aluminum alloy, causing 
serious damage. Two control-room workers at the Surry reactor in Virginia were 
convicted in October 1979 of causing $1 million damage to 62 unirradiated LWR 
fuel assemblies by pouring lye over them "to bring public attention to what 
they described as lax security and unsafe working conditions at the plant" [New 


York Times 1979]. Numerous nuclear facilities of all kinds recei*ved threats, 
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usually bomb hoaxes; during 1969-76, licensed nuclear facilities recorded 99 
threats or acts of violence in the U.S. (76 of them at federal plants), with 
23 analogous threats at government nuclear plants in the U.K. By 1979-80 the 
T? 


J.S. lise had expanded to over 400 incidents, 350 of which were telephoned dombd 


threats to nuclear facilities [Bass et al. 1980:53]. The list omits nuclear- 


related military incidents--such as 11 cases of arson in three months, killing 
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One worker and injuring over 30 sailors, aboard the nuclear-capable aircraft 
Carrier John F. Kennedy, perhaps set by a sailor seeking to delay her sailing 
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- Breaches of security at nuclear facilities. In 1966, 20 natural-uranium 





fuel rods were stolen from the Bradweli reactor in England, and in 1971, five 
more disappeared at or in transit to the Wylfa reactor. In 19 
wounded a nizght watchman at the Vermont Yankee reactor. The New York Univer- 


sity reactor building was broken into in 1972, and the Oconee reactor's fresh- 
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uel storage building in 1973. The fence of the Erwin (Tennessee) plant 
handling highly enriched uranium was partly climbed in 1974 and fully penetra- 
ted in 1975, both times without theft [Smith 1978:Encl. 2:App. J#18,29]; 
likewise at the Kerr McGee plutonium plant in Oklahoma in 1975. In 1975 at the 
Biblis reactor in Germany, then ine world's largest, an MP carried a bazooka 
into the plant under his coat and presented it to the director; a Canadian 
Member of Parliament likewise carried an unchecked satchel into the Pickering 
plant. In 1977, an NRC inspector was admitted to the Fort St. Vrain control 
room unescorted and without having to identify himself [Subcommittee on Energy 
& the Environment 1979:46]; similar breaches have occurred at other reactors. 
In 1976, an unstable former employee drove onto the Three Mile Island site, 
scaled a security fence, entered a protected area next to the Unit 1 reactor 
building, and later drove off the site without being apprenended [NRC 1976]. 
In December 1980, a former employee used a long-out-of-date security pass to 


enter the Savannah River plutonium production plant, where he stole a truck and 


other equipment from a high-security area. In 1976 more than a ton of lead 
shielding was reported stolen from Lawrence Livermore Laboratory, aU.S. bomb 
desizn center [DeNike 1975]. In 1974 several tons of unclassified metal were 
stolen from the nuclear submarine refitting docks at Rosyth, Scotland, appar- 
ently through a conspiracy cf dockyard employees. (Nuclear submarine fuei, 
available at the same docks, is highly enriched uranium, the most easily usable 


bomb material.) [Times 1974a;Hansard 1974] Om 5 April 1970, a classified AEC 





shipment, not fissionable or radioactive, was stolen in an armed REA robbery at 
Newark Airport [Smith 1978:Encl.3:2]. On 14 October 1970, “an AEC courier 
guarding a truck shipment of nuclear weapons components" was held up and robbed 
by three armed persons who took his revolver, wallet, walkie-talkie, submachine 
gun, and keys to the truck, but did not open or take the truck itself [id.:3]. 
In the fall of 1978, the FBI arrested two men for conspiring to steal and sell 
to the Mafia a berthed nuclear submarine in Connecticut, but prosecutors con- 
¢luded they only meant to abscond with the down payment [Bass et al. 1980:15). 


- Nuclear thefts. In 1978, a ship carrving 200 tons of natural uranium 
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was hijacked, allegedly to Israel [id.:75], breaching EURATOM safeguards, but 
the governments concerned kept it a secret for nearly ten years. In 1974, a 
uranium~smugg!ing operation in India to China or Pakistan via Nepal was exposed 
[Times 1974]. There have been numerous natural-uranium-related crimes, some 
involving thefts of ton quantities [Smith 1978:Encl.2:Aret.A #4; Bass et al. 
1980:14-15]. In 1979, an employee at the GE Fuel Processing Plant in Wilming- 
ton, N.C. stole two 30-kg drums of low-enriched uranium, apparently by loading 
them into the trunk of his car, and used them to try to extort $100,000 from 
the management on pain of public embarrassment [Subcommittee on Energy & the 
Environment 1977:4-5; Bass et al. 1980:15]. Over a period of several years, 
twenty truckloads of radioactively contaminated tools and scrap metal were il- 
licitly dug up and sold from a waste dump in Beatty, Nevada [NRC 1976a]. "Vast 
quantities of cannabis resin were smuggled into Britain in radioactive waste 


* then 


drums destined for the Atomic Energy Research Establishment at Hzrwell,' 
recovered by asking to have them back for the Pakistani Customs [Times 1975]. 
There is widespread official suspicion that at least a dozen bombs’ worth of 
highly enriched aranign: vere stolen by insiders from the NUMEC plant in Apollo, 
Pennsylvania during the mid-1960s [Fialka 1979; Burnham 1979]. Some observers 
suspect thefts of HEU at the Erwin, Tennessee plant too, where shortages of 
material have persisted for manv years. Minor amounts of bomb materials--not 
enough to make a bomb, but enough for materials research or validating a threat 
--have been stolen from plants in North America (including one 177-g HEU fresh 
fuel rod from Chalk River in Canada) on at least three acknowledged occasions 
(NRC 1979; Smith 1978:Encl.2:App.J #47, cov. ltr. 2], not counting mere inven- 
tory discrepancies. A substrategic shipment of HEU to Romania arrived with its 
seals tampered with, and the IAEA did not confirm it was all there for "a 
couple of weeks" [Subcommittee on Energy & the Environment 1977:3-7]. 


- Miscellaneous human and institutional flaws. “In October 1974, Ltalian 





government officials announced that they had discovered a plot by right-wing 
terrorists to poison Italy's aqueducts with radioactive waste material stolen 
from a nuclear research center in Northern Italy. The alleged threat was 
associated with revelations of a planned assassination and political coup dy 
right-wing elements. An engineer at the research center was named as a con- 
spirator [and a senior general and the former head of the Secret Service were 
arrested], but the allegations were never substantiated. The case became 
entangled in legal technicalities. Whether the alleged plot, which gained 
widespread publicity in Italy, was real or not has never deen determined." [de 
Leon et al. 1978:30] An analytic laboratory used by the Japanese nuclear 


industry to monitor effluents was shut down by the government for falsifying 














and fabricating test results [Nuclear Engineering International 1974a]; in 





April 1981, a 40-day coverup of improper effluent discharges was revealed at 
Japan's Tsuruga reactor. Commonwealth Edison Co. (the most auclearized U.S. 
utility) and two of its officials were indicted on charges of conspiracy to 
falsify records “by omitting the face that protective doors leading to the 
vital area of the [Quad Cities} plant nad been found unlocked and unguarded" 


(New York Times 1980c]. 





- Malicious use of auclear materials. Though many radioactive sources and 





medical radioisotopes have deen stolen [Finley et al. 1980:App.1; AP 1974; 


Nuclear News 1974; Los Angeles Times 1974,1974a; de Leon et al. 1978:30], and 








some shipments of strategic materials have been misrouted, mislaid, or even 
dropped off trucks [Finley et al. 1980:H-4], only three instances of malicious 
use are known so far: a Squibb radiopharmaceuticals worker put l3lr in 
another's drink (causing a 3.8-pCi thyroid uptake) [E.R. Squibb & Sons, Inc. 
1971]; a nated supervisor at the Cap de la Hague reprocessing plant was exposed 
during six months to about 10-15 R/h of hard gamma radiation from stolen wastes 


secreted under the seat of his car by a worker [Daily Mail 1979a; Not Man Apart 








1981]; and in April 1974 the interior of some train coaches in Vienna was 
sprinkled with substantial but nonlethal amounts of L3l; [de Leon ec al. 
1978:30], contaminating at least twelve passengers. There have been reports 
[Bass et al. 1980:77] of the use in Europe of nuclear materials in an attempted 
Suicide, and that a thief who tampered with a stolen radioactive source may 
well have been killed by it [AP 1974]. A Tulsa radiographer died of radiation 


apparently received froma stolen !92Ir source [New York Times 198la]. 





3.4.2. Nuclear terrorism: resources. 


The foregoing history of actual incidents of nuclear terrorism, sabotage, 
theft, and related institutional failures shows an increasing involvement dy 
international terrorist groups, and a considerable scope for more. It is 
therefore important to examine what sorts of resources such a group can bring 
to bear on nuclear facilities. These resources help to determine the achiev- 
able level of damage. In the substantial Literature of nuclear threat assess-~- 
ment [e.g. Wagner 1977], most of the studies commonly quoted to reassure the 


public that nuclear plants are very resistant to sabotage expressly exclude the 





possibility of “military action and damage dy foreign agents or sudversive 
organizations" [{e.g. Turner et al. 1970]; that is, they consider, in practical 
effect, only lone disgruntled employees and the like. But international groups 
have far greater resources, and some can even call on the resources of wealthy 
governments, which in turn may find such a connection useful for their own 


ends. "Finding modern conventional war inefficient, umeconomical, and ineffec- 
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tive, some nations may be drawn to exploit the demonstrated possibilities and 
greater potential! of terrorism, and emplovw terrorist groups or tactics in sur- 
rcgate warfare against other nations. This requires an investment far smaller 
than the cost of a conventional War; it debilitates the enemy; and it is 
deniable." [RAND 1980:12] Who are these possib’e surrogates and what are 
their strengths and resources? 

There are estimated to be about fifty terrorist organizations in the 
world, with a total of about three thousand active members, perhaps an equal 
number of peripheral supporters, and about two hundred members constituting the 
“primary transnational threat" [Kupperman & Trent 1979:5]. Several groups 
sometimes participate jointly in an action. This makes it difficult to deter- 
mine how many terrorists might be expected to join in a single attack on a 
particular nuclear facility. In the U.S., where the nuclear regulatory philo- 
Sophy encourages formulation of specific threat levels which licensees are to 
guard against, there is a long-runuing debate over this number, and it has 
risen steadily during the past ten vears. At first it was thought to be "seve- 
ral," meaning three, of whom one could be an insider, and there was a consensus 
that security systems were not adequate for this threat [Eschwege 1974:2; Sub- 
committee on Energy & the Environment 1977:204]. Upgraded security measures 
were then again outrun by a heightened threat estimate of a "small group" (six) 
aided by up to two insiders. More recently, after several official studies, a 
consensus has emerged that "fifteen highly trained men, no more than three of 
(whom]...work within the facility..., [the insiders to include] anyone up to 


the higher levels of management," 


is a reasonable threat level [Rosenbaum et 
al. 1974:$6623; Cochran 1977]. But this debate is reminiscent of medieval 
theologians’ disputations, since the history of criminal and terrorist enter- 
prises clearly shows that attackers bring with them "as many as they need...to 
do the job, and no more. The fact that most came with a handful of persons, 3 
to 6, thus does not represent an upper limit on their capacity” but only their 
estimate of what would be "necessary to accomplish their mission" (Office of 
Technology Assessment 1977a:197]. More stringent security precautions would 
simply elicit a stronger attack without obvious limit. 

Another warning against underestimating attackers comes from a review [de 
Leon et al. 1978:42] of past commando raids. Most “were carried out against 
protected targets at least as well armed as the commandos, conditions that 
would hardly seem to bode well for the raiders. Yet, with the advantages of 
greater flexibility and tactical surprise, the raids succeeded three-fourths of 


the time and against some targets whose defenses could have prevailed against 


much larger forces: if one excludes those failures that were not due to enemy 
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action, the commandos were successful almost 90 percent of the time. This rate 
of success speaks highly for the professional skill and ingenuity of the 
raiders, and particularly for their use of surprise. (It also bodes ill for 
the use of mathematical engagement models [or security plans] in which force 
ratios determine the outcome.)" 

The success of such raids depends on accurate intelligence and precise 
planning--especially in such operations as Palmach's destruction of eleven 
Dridges in one night, or raids in which British and Israeli commandos seized 
and carried off German and Egyptian radar dbases respectively [id.:19). Similar 
attributes determined the success of task-force crimes. "In the 45 cases 
reviewed, criminals were able to assemble teams of as many as twenty people 
(yet remain undiscovered), breach thick walls and vaults and neutralize modern 
alarm systems, and devote up to 2 years of planning for a single ‘caper.’" [id.: 
vi]. Considerable technical sophistication has also been displayed lid. 12; 
Burnham 1975:57-59]. “In 1970, an electronics expert connected with organized 
crime was detected in what appeared to be an elaborate method of monitoring the 
activities of the Chicago police. He was cruising near the Chicago Police 
Department's lake front headquarters in a converted mine-sweeper laden with 
radio-intercept equipment.” [i¢.:59]. It is commonly asserted that no group 
as large 2s, say, a dozen people could be assembled and trained for a 
nuclear plant attack without coming to the authorities’ attention; but larger 
groups in past criminal efforts have escaped both notice beforehand and capture 
afterwards. Indeed, 13 mercenaries training with automatic weapons for jungle 
warfare were arrested for trespass after five days' secret maneuvers on the 
borders of the Crystal River nuclear power plant in Florida [Prugh 1981]. They 
were observed more or less by accident, and nobody knew who they were--whether 
they were "a drug-offiloading operation, a subversive group trving to get the 


power plant or a CIA operation,” according .o the sheriff. His aide added: 


"If thev were the real McCoy, we wouldn't have been any match for ‘em....This 


damn sure oughta wake up the nuclear power industry....A good assault team 
could have taken that plant.” [id.] The month after the 13 mercenaries were 


released on their own recognizance. two of them were rearrested with guns and 
explosives in Miami, where it was believed they were about to plant a bomb [Los 


Angeles Times 198l1h). 





Such a straightforward light-infantry group is a less formidable threat, 
however, than just one or two insiders with knowledge of and access to the 
,. ' . , ‘ , ‘ . " 
plant s vital areas. Insider aid has characterized many of the biggest and 
smoothest thefts and hijackings [de Leon et al. 19°78:13f; Bass et al. 1980:17!. 


(Impersonation of insiders has also worked everv time it was tried [de Leon et 
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al. 1978:14]-.) “In che $5.8 million theft from Lufthansa at the JFK Airport, a 
ten-year Lufthansa emplovee was promised $300,000 (more than any other partici- 
pant)...[simply to leave] his post for more than an hour and a half." [Bass et 
’ 


a 


. 1980:17] A Bank of New Mexico burglary on the Sandia nuclear dase in 1955 
appears to have had inside help om the base [de Leon er al. 1978:13], and ocher 
examples cited above indicate that even nuclear facilities requiring the most 
stringent clearance and vetting of employees may harbor potential criminals. 
The former security director of the Atomic Energy Commission was himself sen- 
tenced to three years’ probation in 1973 after borrowing $239,000 from fellow 
AEC emplovees, spending much of it at the racetrack, and failing to repay over 
$170,000 [Satchell 1973]. 

A particularly worrisome sort of insider help is security guards. As of 
1977 [Comptroller General of the U.S. 1977:8], guard forces at many reactors 
not only were of low quality, but had a turnover rate of a third to a half per 
year, with departing guards taking with them an intimate knowledge of up-to- 
date security arrangements. A local newspaper reporter got a job as a security 
guard at Three Mile Island, then prepared a series of articles which the utili- 
tv unsuccessfully sought an injunction to suppress on the grounds that reveal- 
ing “the specific details of the security system...presents a significant, 
serious, grave security threat....[T]here is a threat to the health of the 
public, and national security is involved if someone gets in there to hold the 


plant hostage for whatever reason." [New York Times 1980b] 





A U.S. Marshals Service review of reactor guard forces in 1975 (Comptrol- 
ler General of the U.S. 1977:9] found they had weak allegiance, high turnover 
rate, poor background checks and supervision, inferior equipment, weak legal 
authority, poor rapport with local police, poor mobility, no uniform physical- 
fitness standards, low public confidence, and little training. Many of these 
weaknesses persist today. Background checks have been a particularly sore 
point since a convicted and paroled armed robber got a job as a security guard 
under an alias at the former Kerr McGee plutonium fuel fabrication plant in 
Oklahoma; he was found out and fired in 1974, then six months later arrested in 
connection with an attempted bank robbery in which a woman was shot [Smith 
1978:Encl.2:App.J#8]. Even with honest guards, breaches of security are fairly 
common. A woman working at Browns Ferry forgot she had a pistol in her purse 
and c. ed it through a guardpost undetected in February 1980 (Emshwiller 
1980a: |; GAO auditors in 1977 “were able to pick the locks and open several 
doors to vital areas of [a nuclear power] plant by using a screwdriver or a 


piece of wire...found on the ground near the door” [Comptroller General of the 
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U.S. 1977:15]; and other breaches too numerous to mention have elicited NRC 
fines of utilities on almost a monthly basis. 

Except at the eleven federal facilities handling bomb material, where new 
protective devices include armored cars with light machine guns, U.S. nuclear 
plants are defended by small rumbers of guards with conventional light arms. 
These are clearly no match for the sort of firepower that even a handful of 
terrorists could deploy against a nuclear (or any other sort of energy) facili- 
ty. These potential weapons include the following main categories: 


- Firearms: past terrorist and criminal attacks have used all available 





civilian and military firearms up to and including heavy machine guns, 20mm 


cannons, antitank guns, and recoilless rifles. Modern counterinsurgency arms 
now available to terrorists include [Jenkins 1975a:14] “tiny--some less than 15 


"Automatic weapons are readily available 


inches long--silent submachine guns. 
(Burnham 1975:59]. “Enough weapons and ammunition to outfit 10 combat battal- 
ions numbering 8000 men were stolen from U.S. military installations around the 
world between 1971 and 1974" [Aspin 1975]. 


- Mortars--especially well suited for attacks on spent fuel pools, switch- 





yards, and other facilities unprotected from above. A single North Vietnamese 
mortar team caused about $5 billion damage to the U.S. airbase at Pleiku. "A 
Belgian arms manufacturing firm has...developed a disposable, lightweight, 
silent mortar which can be used against personnel and also fires a projectile 
with a spherical warhead designed to produce a ‘shattering effect’ suitable for 
the ‘destruction of utilities, communications, and light structures.’ The full 
field unit, which weighs only 22 pounds, includes the firing tube plus seven 
rounds. All seven rounds can be put in the air before the first round hits." 


[Jenkins 1975a:14] 





- Bazookas and similar unguided rockets. Aspin [1975] notes that “In 
August 1974, ninety anti-tank weapons were stolen by a Yugoslav national who 


was an employee of the U.S. Army in Germany.” These were recaptured, Dut many 
more were stolen and later turned up in the hands of criminals and terror- 
ists. Their shaped-charge warheads are specifically designed to penetrate 
thick armor. World War [I-vintage bazookas have a range of nearly 400 m. Their 
contemporary version, the U.S. Light Antitank Weapon (LAW), is a five-pound 
rocket effective at 300 m against stationary targets, and shoulder-fired from a 
disposable tube [Kupperman & Trent 1979:56]. One was unsuccessfully fired at a 
West Coast police station in 1974; many have been stolen [Burnham 1975:69]. The 
Similar Soviet RPG-7 was used in the Orly Airport attack in January 1975. Both, 


and counterparts such as the French Strim Fel, are portable, suitcase-sized, 


and easv to conceal or disguise. "[T]here has not been a recent Soviet-influ- 
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enced conflict in which the recipients of Russia's support were not carrving 
RPG-7s" (|Xupperman & Trent 1979:83]. Still deadlier versions are now under 
development, with ranges “far greater" than 300 m [id.:56]. 


- Light, precision-guided rockets designed for shoulder-firing against 





7? 


aircraft (like the Soviet Sa-7 or “Strela” and the U.S. “Redeve™, both of which 





have terminal infrared guidance and a range of several xm). Redeve weighs 
under 30 pounds and is about four feer long; its successor, “Stinger,” is no 
Digger but is faster, longer-range, and more accurate [Jenkins 1975a:13!. The 
British “Blowpipe” is radio-guided by its aimer; the supersonic, tripod-mounted 
Swedish 23-70 has laser guidance, “weighs under 180 pounds, Sreaks down into 
three smaller packages, and can be operated dy one man with minimal training”. 
These latter two missiles can shoot down aircraft approaching head-on lid.}. 
Palestinian terrorists have Strela rockets and were arrested with some near the 
Rome Airport in September 1973 and at the edge of the Nairobi airport in 
January 1976 [Kupperman & Trent 1979:30-31]. A Strela may have been used to 
shoot down two Rhodes‘. passenger planes in the past three vears. It could 
be used both for standoff attacks on stationary facilities and to shoot down 
incoming airborne security forces. 


- Analogous precision-guided munitions (PGMs) designed for antitank use. 





The U.S. "Dragon" and TOW rockets and the Soviet "“Sagger"™ are wire-guided, use 
laser target acquisition, have ranges of several «km, weigh generally under 30 
pounds, and can be carried and operated by one person. The French/Gernan 
“Milan,” somewhat smaller and with semiautomatic guidance, is even more port- 
able and is being deploved by the tens of thousands [Jenkins 1975a:14]. The 


Dragon, TOW, and Sagger shaped-charge warheads “can pierce several feet of 
homogeneous armor plate" [Kupperman & Trene 1979:55]. They are more commonly 
available than their anti-aircraft counterparts. It would not be surprising if 
at least hundreds of them were in terrorists’ hands today. They are ideal for 
standoff attacks against even semihardened nuclear facilities, as weil as for 
attacking any vehicles in which security forces would be likely to arrive. 


- Specialized rockets and grenades. The German-designed antitank "Arm 





brust 300," designed for urban warfare, “has no backblast, making it possible 
to fire the weapon from inside a room--something no rocket launcher can do now, 
The Germans expect to produce the ‘Armbrust’ in large quantities.” [Jenkins 
\975a:14] A new projectile that can be fires from .the U.S. M-79 grenade 
launcher (many of which have reportedly been stolen) “is capable of penetrating 
two inches of armor plate and igniting any fuel behind it." (id.| 


- Poison gas. In April 1975, terrorists stole three liters of mustard gas 





from German Army bunkers; several cities, including Stuttgart and Bonn, were 
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- 


threatened with a zas attack (Guardian 1975a]. The “Alpnaber Bomber" threat- 





ened in 1974 to “destrow the entire personnel of Capitol Hill” with two rons of 
Sarin nerve gas, and had in fact assembled all but ome of the ingredients need- 
ed to make it [Bass et al. 1980:25-26]. A letter bomb containing a vial of 


nerve gas has reportedly been intercepted in the United States [Evening Stand- 





ard 1976]. Viennese police in 1975 arrested German entrepreneurs for conspir- 
ing to sell rabun nerve gas in the Middle East ([Kupperman & Trent 1979:5]; they 
had already made a liter of it--a mere whiff of which would cause unconscious- 
ness in five seconds and death within five minutes--and packed it into dottles, 


capsules, and spray cans [Evening Standard 1976; Ottawa Citizen 1976]. Methods 








of making such substances have been published, and some highly toxic nerve-gas 
analogues are commercially available in bulk as organophosphorus insecticides. 
An inhaled lethal dose of sarin nerve gas to a normally respiring 70-kg person 
is about 1 mg. VX nerve gas, whose method of preparation has also been printed, 
is ten times this toxic by inhalation and 300 times as toxic by contact [Kup- 
perman & Trent 1979:65], and can be made by a "moderately competent organic 
chemist, with limited laboratory facilities” and willingness to take risks 
lid.] . Nonlethal incapacitating gases like Mace® are also widely available. 


- Explosives, including breaching, shaped, platter, airblast, and fuel-air 





detonation charges. These are readily available at a wide range of sophistica- 
tion, ranging from disguisable plastic explosives and specialized cutting and 
penetration jets to the crude 770-kg truckload of fertilizer/fuel-oil explosive 
which destroved the Army Mathematics Research Center at the University of 
Wisconsin in 1970 [Pike 1972]. (Such a charge at 10 m produces overpressures 
of order 150 psi, six times the level severely damaging reinforced concrete.) 
Many tons of commercial explosives are stolen every year [Burnham 1975:50). 
Nuclear explosives offer special capabilities that will be considered below. 


- Aircraft. The same zroup that caused one death and $6 million in damage 





with the ANFO truck bomb at the University of Wisconsin had also tried to sabo- 
tage a power station supplying a munitions plant, and had made an unsuccessful 
aerial attack in a stolen airplane against the same munitions plant [Burnham 
1975:49]). Fixed-wing aircraft have been used in several bombing attempts, par- 
ticularly in Northern Ireland. Helicopters have been used in jailbreaks in the 
U.S. [de Leon et al. 1978:35] and in Mexico and Eire, and bv Pfc. Robert K. 
Preston in his 17 February 1974 landing on the White House lawn. Palestinian 
terrorists have recently used even a hot-air balloon to enter Lebanon, and of 
course Nazi commandos often used gliders with great success. Commercia! and, 


on occasion, even military aircraft are hijacked throughout the world, and 


could be used for access, weapon delivery, or kamikaze attack. 
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- Ships, small submersible vessels, and frogmen are undoubtedly available 





to terrorists. Ships carrying torpedoes, depth charges, and guided rockets mav 
Se available. Portable missiles can de fired even from a rowboat. 

- Tanks and similar vehicles are sufficiently available ar 
and Army bases, where a wide variety of other sizable weapons have been sto 
in the past, that it ts not unrealistic to contemplate their hijacking. Some 
incidents of this kind have already occurred. Just heavy construction equip- 


ment, which is commonly available to civilians, lends itself to adaptation, and 


| 


could readilw de armored to withstand the light-infantrv arms issued to guards. 
In Louisiana in June 1967, a large construction crane was driven into three 


large transmission-line towers to destroy them [McCullough et al. 1968). 
3.4.3. Sabotage of nuclear facilities. 


With such firepower at their command, what technical vulnerabilities might 
enable terrorists (or acts of war) to achieve major releases of radioactivity 
from nuclear facilities? 

The first thing to be understood about those facilities is that their 
radioactive inventories are very large. The magnitudes involved--and the dili- 
gent attention needed to prevent their accidental relezse--can be illustrated 
dv a few simple examples. At equilibrium, a 1-GWe LWR contains over 15 GCi* 
of radioactivity, including about 12.5 GCi of fission products and 3.1 GCi of 
persistent transuranic elements such as plutonium. Among the more important 
fission products is 72 MCi* of volatile iodine-13l (13ly), a thvroid-seeker 
with a half-life of about a week. (This means that half of its remaining radi- 
Sactivity decavs weekly, so that after ten half-lives it is reduced to 1/1024th 
of its original potency; after twenty half-lives, to just under a millionth; 
and so on.) Holdren [1974] points out that a quarter of that l3lr inven- 
torv would suffice to contaminate the atmosphere over the 48 coterminous States 
to an altitude of 10 iam to twice the maximum permissible concentration (MPC) 
for that isotope. Half of the 5.2-MCi inventory of the important bone-seeking 
fission product strontium-90 (99s), which has a 28-vear half-life, would 
suffice to contaminate the same area's annual freshwater runoff to six times 
the MPC. Such estimates are used not to suggest that such widespread, uniform 
dispersion would actually occur, but to stress the exquisite care that contain- 


ment of such large inventories demands. 





Another calculation [Morrison et al. 1971] assumes that, in accordance 
with the “design basis accident,” all the radioiodine in . l-GWe LAR is vola- 
"One curie (Ci) undergoes 3° Sillion disinterrations per second--the activity 


of a gram of radium. One GCi (billion Ci) or MCi (million Ci) is a huge unit. 








* that containment then 


fails or is deliberately breached, then half of its radioiodine inventory (a 


Quarter that in the core), held up for a dav (4.6-fold decav), will produce 


@ meterological cond:tions cloud-centerline dose of 300 


3 
rem to an adult tavroid at a downwind range of 200 mm. Such a dose, while nof 


be). is certainly more 
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acutely dangerous (as a 300-rem whole-dody dose w 
than would be considered tolerable. Before placing too much faith in the con- 
tainment, it 1s worth noting that the integrated decay heat from the core would 
suffice to melt down through an iron cvlinder 3.3 m in diameter and over 710 m 
high Lid.J--to sav nothing of possible steam or hydrogen explosions or other 
effects involving thermal shock, carbon dioxide pressure from decomposing 
concrete, etc. This decav heat, arising from radioactive decay in the core, 
cannot be turned off, reduced, or controlled in any way, and must he safely 
removed somehow--a key distinction between nuclear heat and heat from chemical 
combustion. 

This decay heat--initially about 6-10% of the reactor's full-power heat 
Output, thus amounting to hundreds of megawatts for a modern power reactor-~-is 
only ome of its several sources of internal energy which, properly harnessed, 
can help a saboteur to release much of the core's radioactivity, even if the 
reactor has already been shut down. Another is the potential for chemical 
reactions (such as Zircaloy/water or hydrogen/oxygen). Yet another is the 
pressures and momenta of internal fluids: in a big PWR, the mechanical energy 
of circulating not water is equivalent to about 0.025 kT, and its thermal 
energy, to several «kT. Much of the reactor'’s complexity arises from multiple 
Drotective devices which are supposed to prevent a major release; but these all 
nave their vulnerabilities. 

Among these is their need for electric power. Without electricity, most 
of the shutdown, cooling, and control devices cannot work. Few have adequate 
battery storage; instead, they relv on offsite power from the grid, onsite 
power from the station's own switchyard, or emergency diesel generators (which 
are not verv reliable). The Rasmussen Report's fault and event trees [NRC 
1975! reveal that common-mode electrical failure causes severe and unstoppable 
meltdowns in which most mitigating devices do not work. Low-technology sabotage 
could disable diesel generators in between their periodic tests, then at leis- 
ire, before thev are fixed, cut offsite power. One person without special 
skills could do both, either dy access to the site or (in most cases) 5v stand- 
off attack, as the diesels are cften dbadlv protected and sometimes housed in 
ight external sheds. Operating power reactors have already experienced fail- 


ure of all backup power (fortunately not simultaneous with a zrid outage) 
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he 


Pollard 1979:42] and T@c grid instability resulting in reactor shutdown and 
area blackouts [id.:40]. 


- 
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More complex modes of attack can de designed with the aid of the Rasmussen 


Renort and detailed design information publicly available [Subcommittee on 


>215]. They can either mimic hypothetical accident 
sequences, as most analyses assume is necessary, or simplify and shortcut 
them. Two promising approaches are producing a rapid power excursion, beyond 
the reactor’s ability to cool the fuel (a worrisome class of potential acci- 
dents, especially in BWRs), and “interrupting the supply of cooling to a shut- 
(id.:14] so that its decay heat--initially many kWt per liter of 
core~~melts the fuel. These can be done from either onsite or offsite, the 
latter referring to remote targets or to use of standoff weapons against the 
plant itself. Remote targets include transmission lines, related switchyards 
and transformers not onsite, and any cooling-water intake necessary to provide 
an ultimate heat sink to the plant: for any power plant, but especially for 
nuclear plants because they need cooling for decay heat after shutdown, "the 
screenhouse [intake structure! is probably the most vulnerable point for sabo- 
tage in steam generating stations." [Bisset 1958] (This may also be one of the 
things Dr. Bruce welch, a former Navy Underwater Demolitions officer, had in 
mind in his widely publicized Joint Committee on Atomic Energy testimony, 28 
March 1974, that with a few randomly selected military demolition people he 
could sabotage virtually any nuclear reactor in the country." A retired Green 
Beret colonel, Aaron Bank, gave unpublished JCAE testimony to similar effect 
about San Onofre, whose intake structures are unusually accessible.) Standoff 
weapons, desides conventional ones such as mortars, rockets, precision-guided 
munitions, fixed-wing and helicopter aircraft, etc., may include remotely pilo- 
ted aircraft (the remote-control apparatus now widely available to hobbyists is 
probably adaptable to operating standard light aircraft). Inspection of seis- 
mic resonance analyses of major reactor structures also suggests that an exotic 
possibility --standoff attack bv infrasound generators tuned to published reso- 
nant frequencies--cannot de wholly disregarded; and of course key control and 
safety circuitry, as noted on 9.96, may be vulnerable to electromagnetic puls- 
es, fair facsimiles of which can be generated with homemade standoff devices. 
Insit2 overt attacks could be meant to take over the plant. The staff 
sould be subdued or killed with ordinary weapons or bv introducing a rapidly 
Lethal gas into the ventilating svstem., The latter method might de quick 
enougn CO prevent operators from raising the alarm, isolating control-room 


ventilation, or shutting down the reactor, and it might be the method of choice 


t also raises the question, nowhere answered in the 
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literature, of how safe a power reactor would remain if all its staff suddenly 


dropped dead.) Once the plant nad been seized, its security devices and the 


shielding and life-support systems of the control room would ail help to 
protect its occupiers from both invaders and external radioactive releases. 
The occupants could then do either of two things, or both in succession, at 
comparative leisure. 
First, thev could use their power over the costly plant and its dangerous 
contents as a basis for political negotiations. These might de secret initial- 
ly, with the threat of disclosure and ensuing public panic used as a bargaining 
chip. Various concessions could be demanded. In their absence--or possibly 
straightawav if the occupiers are of the tvpe that prefer people dead to people 
watching, or cannot competently maintain the plant in safe condition--serious 
damage could be undertaken, leading at a minimum to the economic loss of the 
plant and probable ruin for its owners; at a maximum, to major releases. 

Two types of deliberate damage, not mutually exclusive, seem possible. 
Mere demolition is straightforward. Blowing holes in the crucial containment 
building is not even necessary, since terrorists cam simply open its personnel 
airlock doors. (Schleimer [1974:27n8] notes that the San Onofre information 
center showed every hour a film demonstrating how these doors work.) Mindful 
of the near-miss at Browns Ferry, a low-technology saboteur with an experimen- 
tal frame of mind might want to see what arson in the cable-spreading room 
would do. Alternatively, depending on the occupiers’ technical knowledge, con- 
trol systems might be disabled, bypassed, or reversed so as to make the plant 
destrov itself. Both normal and emergency coolant could be removed or stagna- 
ted. In some circumstances, large overpower transients might be achievable, 
especially with the help of insiders. The occupiers could use, alter, or dis- 
able ali the electrical systems, controls, cables, valves, pumps, pipes, etc. 
virtually at will. Even major components are highly vulnerable to commercially 
available shaped charges, to thermic rods ("burn bars"), and to thermal shock. 

Once sabotage had begun, repairs and countermeasures could rapidly become 
impossible even if the plant's operators quickly regained control of the site. 
Key parts of the plant could by then already be filled with steam, water, 
Noxious gases, or high levels of radioactivity. It could be impossible even to 
assess damage. Access to the inside or outside of the plant could readily be 
interdicted by radioactive releases, chemical poisons, or conventional muni- 
tions wielded by defenders from their concrete fortress--which their adversar- 
les would hardly want to Gamage. Those adversaries would nave to include and 
soordinate counterinsurzgency forces, health=-phvsics teams, and reactor engin- 


_ 
* 
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Pers, urther, though one can doubtless assume considerable ingenuity and 
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courage on the part of the forces of law and order, the history of major 
muclear accidents suggests that one can also expect a full measure of confus- 
lon, error, foolishness, and possibly panic. Panic would almost certainly 
ensue in downwind areas, probably leading to considerable loss of life and 
Droperty and hindering the arrival of backup teams. and of course if a melt- 
down did occur, then events onsite and releases offsite would, dv general con- 
sensus, de uncontrollable and unstoppable in principle, owing to extreme radia- 
tion fields and the formidable temperatures, masses, and chemical properties of 
the materials involved. Major psychological, political, and economic trauma on 
a national or world scale would be inevitable. Civil liberties and indeed 
civil (as opposed to martial) law would probably, as in a nuclear domb threat, 
be among the early casualties [Blair & Brewer 1977]. 

Any consideration of potential releases of radioactive material by 
sabotage or war must look at the whole nuclear fuel cycle, not just reactors. 
One modest but ubiquitous source, passing through the midst of our largest 
cities, is casks carrying spent reactor fuel. A single 3-element shipment, 
after 150 davs' cooling, still contains several megacuries [Finley et al. 
1980:103], including 0.52 MCi of radiocesium (1346,137cs)a biologically 


*. 


active auclide slightly longer-iived than strontium-90 and even more important 
from the standpoint of land contamination, since, unlike strontium-90, it emits 
penetrating hard gamma ravs. A highly unlikely accidental dispersal of a much 
smaller spent-fuel shipment, totalling only 0.2 MCi, in New York City is calcu- 
lated Lid. :65-66] to cause $2 billion in land denial dy contamination. (This 
is not a worst case. Dispersal of 10 kg of plutonium oxide, of which only 5% 
1s assumed to become airborne, causes the same contamination damage plus over 
2000 deaths. Dispersal of a 144-Ci polonium-210 source causes scores of deaths 
and $9 Siilion in contamination. All these are shipped through cities too.) 

A far larger source term is the inventory of spent fuel in storage pools, 


re also at Awav-fromReactor (AFR) 


eC 


currently at reactors but pernaps in the fut 
centralized pools [Dinneen et al. 1980]. Pools at reactors are often badly 
d 


protected; many are above grade; and the fuel, especially in its first few 


months of storage, may require active cooling to keep it from melting. And an 
: 9 
even more concentrated source of long-lived contaminants, notably 99S and 


§$, iS tanks Sontaining Nignw.evei reprocessing wastes--tne source of 


fication of hizh-level wastes, and are currently holding large inventories at 
'.S. sites ‘west Valley NY, Hanford WA, Savannah River Ga, and [dano 


Falls ID). The inventories of ‘tonzg-lived isotopes at several sites are in tne 
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GCi (billions of curies) range--enough, if a substantial fraction is dispersed, 
to make a subcontinental area uninhabitable for several centuries. A Barnwell- 
sized (1500 T/y, or about 50-reactor) reprocessing plant, after five vears' 
dperation, stores nearly 5 GCi of the especially hazardous nuclides zirconium- 
95, niobium-95, ruthenium-103 and -106, and cesium-134 and -137, plus 0.8 GCi 
of strontium-90. Simple plume calculations suggest that a 1% release from this 
inventory with rainout from the plume could contaminate tens of thousands of 
Squar2 miles with persistent radiation of tens of rem per year. 

To make such a release easier, the reprocessing plant itself, like a 
reactor, provides substantial internal energies [Gorleben International Review 
1979:Ch.3]: large amounts of flammable solvents, ton inventories of fissionable 
materials that must be carefully protected from accidental criticality, hot 
reactive acids, thermally and radioactively hot spent fuel and wastes, and such 
possible accident initiators as a product of solvent radiolysis known as "red 
oil," which is not well characterized but is empirically known to be an easily 
detonated high explosive. It is also noteworthy that such a plant separates 
annualiv in pure, readily handled form of the order of 10-15 tons, thousands of 
dombs' worth, of plutonium; in five years the plant separates more fissile 
material than is present in the entire U.S. nuclear arsenal, accountable with a 
precision unlikely to be much better than 1%. A saboteur with access to 
plutonium-dioxide loading or storage areas could assemble in a few minutes, 
using other materials already present in the plant, a crude nuclear bomb with 
2 yield of order 0.01-0.5 kT--more than sufficient to disperse virtually the 
whole plutonium inventory and probably a good deal of the fission-product 
inventory too. (No reprocessing-plant security plan envisages this method.) 

Accidents at the Savannah River reprocessing plant have already released 
133 Ci of radioiodine (about ten times the Three Mile Island release) in five 
days (Marter 1963] and 479 kCi of tritium in one day [South Carolina Department 
29f Health & Environmental Control 1974], but these releases, however signifi- 
cant (Alvarez 1980], are trivial compared with what even a modestly serious 
accident could do [Gorleben International Review 1979; Hatzfeldt et al. 1979: 
78-98]. Such an accident may have been narrowly averted at the Capde la Hague 
reprocessing plant in France on 15 April 1980 when a supposedly impossible 


total electrical failure Sriefly disabled vital cooling and safety equipment. 


The potential was also odliquely illustrated by two U.S. 


a 
lumehandling piants. In the firse, Gulf United Nuclear's Plutonium Facility, a 


Mixed-oxide fuel fabrication plant at West Pawling 
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December 1972 a fire and two explosions of unspeci 


an undetermined amount of slutonium around the facilitv, which was then perma- 














nently closed [Cochran & Speth 1974:10-17]. In the second, the Rocky Flats 

plutonium weapon-component plant 15 miles from Denver suffered on 11 May 1969 a 
tire that appears to have been the costliest industrial accident in U.S. histo- 
ry. General Giller, then USAEC Director of Military Applications, testified in 
SudDcommittee hearings [Committee on Appropriations 1970] that the fire was "a 
near catastrophe" and that “hundreds of square miles" could have been contami- 
nated if the fire nad burned through the roof. “If the fire had deen a little 


Digger," he said, “it is questionable whether it could have been contained.” 
These incidents raise the disturbing question--generic to nuclear plants-- 
of "lLoss-of-supervision" scenarios [Gorleben International Review 1979:Ch.3] 
whereby a serious release sufficiently contaminates the plant and its environs 
that it can no longer be properly maintained to fix the damage or even to pre- 
vent further deterioration. Experience at the Seveso chemical plant in Italy 
suggests this is far from idle speculation. [It was not far from happening when 
the Browns Ferry control room filled with acrid smoke in 1975 [Comey 1975], or 
when a storage tank two miles from the Fort Calhoun, Nebraska nuclear plant 
spilled 150 tons of anhydrous ammonia in November 1970, forming a 35-foot-thick 
layer of ammonia that covered some 1000 acres [Pollard 1979:26] (nuclear plants 
do not always have enough breathing apparatus for everyone). Chester [1976] 
says that sabotage of the cooling system on a high-level waste tank would lead 
to boiloff of the water and release of fission products, but this "would take 
weeks or months, allowing ample time for detection and repair." What if the 
sabotage has already released so much that nobody can do the repairs? [Gorleben 
International Review 1979:Ch.3] In 1977, workers at the Windscale reprocessing 
plant in England went on a 6-week strike, and a cladding fire was feared when 
they would not allow liquid=-nitrogen shipments to cross picket lines. Eventual- 
ly the [Labour] energy minister had to threaten to cali in the Army [AP 1977]. 
The loss of supervision could be caused dy violence, not contamination: 
as noted above, the operators could be dead or incapacitated. Carl-Friedrich 
von Weizsdcker recalls a colloquy in which Norman Rasmussen was insisting 
that the operators would always stay at the plant to keep it safe: they must 
because the regulations said so. Von wWeizsdcker persisted, "What if they 
don't? what if the reactor is in Beirut, the operators are Christians, and the 
Syrians are coming?" Whereupon a third person remarked, "I've learned more 
about reactor safety in the past five minutes than in the previous ten years.” 
Possible envelopment by an LNG or LPG fireball has already been mentioned 
as a possible event that could endanger a nuclear facility and disable its 


Operators. Another is airplane crashes. On 25 August 19/72, a light plane lost 
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in dense fog crashed into the Millstone (Connecticut) reactor complex, disab- 


ling the 27.6-kV feeder for the transformer operating shutdown svstems and cut- 





ting off-site telephones for three hours. (The plant did not reduce power.) 
(Pollard 1979:39] The Big Rock Point reactor in Michigan was apparently such 7 
zocd landmark that Air Force crews used it for practice bombing runs. On 28 
Mav 1973, the Prairie Island reactor was repeatedly overflown at low altitude 
by a light plane piloted by a known criminal who appeared to be photographing 
it; subsequent FBI investigations "did not reveal any malevolent intention or 
violation of the law." [Smich 1978:Encl.2:App.J #10] On 3 September 1975, an 
Air Force 8-52 carrying no weapons exploded in flight and crashed about 20 


miles from the Savannah River reprocessing plant [Washington Post 1975}. On 10 





November 1972, three men hijacked a Southern Airways commercial flight to 
Canada, made the pilot circle over the Oak Ridge complex, threatened to crash 
the plane into it (reports vary as between the Oak Ridge Research Reactor and 
the Y-12 plant), collected a reported $2 million ransom, and landed in Cuba 
[Burnham 1975:124]. 

In view of this historv, it is disturbing that most plants are designed to 
withstand a crash only of a fairly small aircraft. Wall [1974], for example, 
offers an analvsis based on a 1968 census of the civil aviation fleet, before 
widebody jets, and considers the impact only of the engines, not of the air- 
frame. Likewise, the official safety report for the proposed Gorleben repro- 
cessing plant in the Federal Republic of Germany considered only crashes by 
Phantom jets at 215 m/s, whereas a Boeing 747 at 200 m/s would produce a peak 


impact nearly six times as big and lasting more than twice as long [Hatzfeldt 


et al. 1979:92]. By a lucky irony, the double containment strength that enab- 


led the Three Mile Island containment shell to withstand the hydrogen explosion 
was designed in because a commercial flight lane for low-level approaches to 
the Harrisburg airport passes essentially over the plant; but it is unlikely 
that most reactors or other nuclear facilities are really equipped to handle a 
crash by well-laden widebody aircraft. The tendency of the jet fuel to cause an 
after-crash fire about half the time would also complicate shutdown and repair 
efforts in the stricken plant. 

Our selection of examples of poten . sabotage has deen illustrative, not 
comprehensive. Many other points of vulnerability can be found in the nuclear 
fuel cvecle. For example, heavv-water plants, operating at Savannah River and 
In Canada, have enormous inventories of hydrogen sulfide, whose toxicity limit 
'$ 550 ppm or 750 mg/m3, Some official calculations suggest that a major 
release of H5S could be about as hazardous as a modest reactor accident; 


and the plants have far less protection than a reactor. Wwe have also not 
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sought here to consider all possible methods of sabotage, even in general 
terms. Many nuclear facilities, for example, are highly vulnerable to insider 
reprogramming or disabling of their control computers, resetting of their 
instrument trip points, biasing of their calibration standards, etc. I: is 
also possible to attack a plant by standoff in time rather than in space. Now 
that digital watches with long-lived, low-drain batteries are widely available, 
along with sophisticated and highly reliable electronics of all kinds, it is 
feasible to conceal a conventional chemical bomb (or at least to say one has 
done so) in a reactor under construction. One extortionist recently claimed he 
had put a bomb in a concrete wall being poured at a reactor, and it proved 
very difficult to find out whether the claim was true. On occasion, foreign 
objects considerably more obtrusive than a lump inside a concrete wall have 
escaped detection for a surprising time: on 3 May 1972, for example, Common- 
wealth Edison reported to the AEC that they had retrieved a complete Heliarc® 
welding rig, complete with 7.5-m cables and hose, from inside a malfunctioning 
jet pump. Substantial foreign bodies have even been retrieved from reactor 
cores. The technical and operational sophistication of the extortionist's bomb 
that caused $3 million damage to Harvey's Resort hotel-casino in Stateline, 
Nevada on 26 August 1980 (giving rise to hundreds of imitative threats over the 


following year [Los Angeles Times 1981f]) suggests that this sort of threat, 
ge: 





skillfully done, could shut down a lot of nuclear capacity virtually at will. 


3.4.4. Consequences of major releases. 


Having reviewed the kinds of resources and techniques that can de devoted 
to achieving a major release of radioactivity from nuclear facilities, we must 
now consider the possible consequences--radiological, social, and economic. 
Unfortunately, most of the literature on major nuclear accidents may understate 
the possible results of successful sabotage. According to the Genera! Accoun- 
ting Office [Comptroller General of the U.S. 1977:6], a classified Sandia as- 
sessment of reactor sabotage, for example, found that the consequences could 
not exceed the maximum calculated in the Rasmussen Report [NRC 1975] for a 
major accident--3300 prompt deaths, 1500 delayed cancer deaths per vear for 
10-460 vears, and 314 billion in property damage. Yet the Rasmussen Report did 
not present those figures as the results of a worst possible accident: worse 
ones were ohysically possible but were assigned a low probability and not 
considered [Kendali et al. 1977:61f]. Further, a saboteur would be free to 


select all-worst-case conditions--rear-urbdan reactor, mature core, meteomlogi- 


9 


cal inversion, wind blowing toward the citve-and could disable mitigating 
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Systems (such as containment spravs) and breach the containment. Nonetheless, 
most commentators have uncritically accepted contentions dy the Sandia group 
(whose supporting analysis, if any, is unavailable to the public), in the 
Rasmussen Report itself (which provided none--it nowhere considered sabotage), 
and elsewhere that the consequences of sabotage could not exceed those of a 
serious accident. That finding has never been justified in open literature anc 
"is very likely untrue™ [id.:61]. For lack of better data, however, we shall 
take the consequences of accidents as indicative of those of successful sabo- 
tage; and it is common ground that both could be graver than any peacetime 
disaster, and perhaps any wartime disaster, in recent world history. 

A recent review [Beyea 1980] of the long-distance consequences of major 
accidental releases from a power reactor--assumed for analytic specificity to 
be Three Mile Island--finds that delayed effects, especially thyroid damage and 
land contamination, “can be a concern more than one hundred miles downwind from 
an accident and for many decades" [:4], i.e. far beyond “the distances for 
which emergency planning is required by current Federal guidelines” [:2]. Such 


lerge releases can arise in accidents only if the containment building fails 


Or is bypassed, but this can occur with or without a full core meltdown, due to 





isolation failure, overpressurization after containment sprav failure, or per- 
haps a hydrogen explosion [:6]. (The hydrogen explosion during the TMI acci- 
dent may have been sufficient to breach smaller or weaker containment buildings 
in use at many other reactors [id.].) A core meltdown would add the possibili- 
ty of violent steam explosions, and would release enough hydrogen or carbon 
dioxide or both to make the probability of containment rupture about 0.2 
(according to the Rasmussen Report) for large containments and nearly 1.0 for 
small ones, such as those on nearly all boiling-water reactors [:6-7]. Disper- 
sion calculations show [:11-13] that depending on wind direction, delaved 
cancer deaths alone, in the 75 years following the release, bevond 50 miles 
from the reactor (ignoring all those closer to it), would probably range from 
about 0 to about $0,000 under tvpical meteorological conditions, assuming the 
reactor core was mature, i.e. to be refueled shortly. The beyond-50-miles zone 
would also suffer a similar number of genetic defects, from 0 to about 450,000 
thyroid nodules, and land contamination of from 0 to about 5300 square miles 
with short-term farming restrictions on up to 175,000 square miles). Most of 
this population exposure would be at doses of order tens of rem or less. Prompt 
deaths, from whole-body exposure over 150 rem, would occur only within a few 
tens of miles of the reactor. This region, which in some cases (e.g. Indian 


Point, Zion) includes major cities, is exciuded from Bevea'’s calculations but 
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considered in such studies as the Rasmussen Report [NRC 1975], whose “maximum” 
comsecuences are noted above. 

Another recent analysis [Fetter & Tsipis 1980,1981] has compared the ra- 
Zioactive releases that might be caused by a major reactor accident, a nuclear 
2xplosion, and the former caused by the latter. The radioactivity from a one- 
megaton bomb explosion is some 40 TCi (4 ~« 10!3 curies) at detonation, 
compared with an equilibrium core activity of over 15 GCi--over 2000 times 
smaller--for a l1-GWe light-water reactor. But the activity of the bomb debris 
decavs far faster, so that after the first hour, the bomb activity is oniy one 
and a half orders of magnitude greater than the reactor's; after a day, the 
same; after a month, an order of magnitude less (i.e. of the same order as a 
10% release from the reactor core to the environment); after a year, 10 times 
less; after five years, 100 times less; after 25 years, 1000 times less [:20- 
22]. Accordingly, a bomb that vaporizes a reactor core will greatly increase 
(by tenfold after one year) the amount of interdicted land. Assuming a ceiling 
dose limit of 2 rem/y to resettlers, the area seriously contaminated for centur- 
ies would be hundreds of square miles (a total of about 400,000 square-mile- 
years), or about forty times that caused by a Il-megaton surface burst. As we 
shall note below, similar consequences could arise from a bomb “even of rela- 
tively small vield, such as a crude terrorist nuclear device” [1980:29]. That 
could indeed be worse, since lower yield would not carry the debris so high, 
and the reactor fallout would therefore be sooner and more intense than if 
spread over a large stratospheric volume by the strong updrafts of a high-yield 
explosion. 

Thus a nuclear-capable terrorist or a “determined or desperate combatant 
(in Europe] can, by waiting for the proper weather conditions, devastate a 
substantial fraction of the industrial capacity of an opponent with a single 
nuclear weapon aimed on a reactor.” [1980:29] The activity released would 
exceed, perhaps by one or two orders of magnitude, the release in a reactor 
accident. (Bevea [1980:E-4] assumes a maximum release of 50% of core cesium 
and rubidium, 70% of iodine, 90% of noble gases, 30% of tellurium and antimony, 
6% of barium and strontium, 2% of refractory metals, and 0.4% of lanthanides 
and actinides. He rotes, however [:8], that the actual TMI accident released 
adout as much activity from the fuel elements as had deen expected in a fult 
meitdown for release of volatile elements alone, such as cesium and iodine. 
Even a small bomb could cause essentialiy 100% release of the entire core.) 

Holdren [1981] adds an important footnote to Fetter and Tsipis's calcula- 
tions: if, as Beyea has done, thev also consider the long-term, long-range dose 


commitments, then a reactor accident alone, with no bomb detonation neardv, is 
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“within a factor of two of the [one-megaton surface-burst] bomb at distances out 


to 200 km, closing in beyond that distance and delivering higher total doses 
than the bomb devord about 900 km." In an even more direct comparison [:3], 
Bevyea's worst-case accident gives a dose commitment of about 120 million 
person-rem, compared to Rasmussen's 1000 million; whereas OTA [1979:13] implies 
10-100 million person-rem for a 1-MT airburst and 250-3000 million person-ren 
from a 1-MT groundburst. Thus, contrary to the Fetter and Tsipis conclusion 
[1981], which concentrates on near-term, short-range effects, even a i-MT 
Zroundburst is not necessarily more destructive radiologically than a severe 
reactor accident. But conversely [Holdren 1981:4], “the possibility of mali- 
cious as well as accidental destruction of a reactor core” returns again to 
"the unfortunate links between nuclear power and expanded access to the raw 
materials of nuclear weaponry....For the staggering radiological consequences 
of destruction of a nuclear reactor by a nuclear weapon--the third case consid- 
ered by Fetter and Tsipis--put the radiologic damage potential of a fair-sized 
muclear arsenal into the hands of any nation or terrorist group with a single, 
LO0-kiloton bomb." (As noted below, a smaller vield would also suffice.) 

The consequences of a single act of nuclear sabotage can be comparable, 
then, to those of nuclear war. Remote siting, undergrounding, containment vent- 
ing filters, evacuation, thyroid blocking, sheltering, air filtration, and 
other measures meant to mitigate the effects of veactor accidents would be 
grossly unequal to the task. The Nuclear Regulatory Commission does not seem 
much interested even in these modest measures [Beyea 1980], and the nuclear 
industry seems to feel that mitigation methods are unnecessary or embarrassing. 
(For example, the Senior Vice President of Philadelphia Electric Company tes- 
tified on 27 May 1980 that “Evacuation plans are just the window dressing and 
the final back-up plan"; that a 1.7-mile Low Population Zone for evacuation 
planning around Limerick is "more than adequate"; and that “Emergencies that 
will require evacuation will noc occur." [Kostmaver & Markev 1980]) This lowers 
still further the threshold for sabotage that can be disastrously effective. 

So far we have considered consequences only at a crude level--death, dis- 
ease, land denial. But at a societal level, psvchological impacts mav in fact 
be more important [e.g. Lifton 1967; Del Tredici 1980; Perelman 1979]. Whether 
reactor sabotage is technicalliv successful or not may be less important than 
whether people think it may succeed. The psychological impact of a potential 
release was strikingly confirmed even before Three Mile Island when a War-of- 
the-Worlds-tvpe radio drama broadcast in Denmark on 13 November 1973 described 
a supposed 1982 meltdown in the Barseb¥ck reactor in Sweden (visidle across 


the narrow straits from Copenhagen), allegediv sending an invisible 5ut deadly 











194, 

ia? 
plume towards the Danisn capital. Residents panicked; some began [Co evacuate; 
some thought their loved ones dead; and it took hours of repeated assurances 


that it was all fictitious before people got the message [Nuclear Engineering 





International 1974]. 





Since “large numbers of people in many countries have become acutely 
concerned" [Ramberg 1978:4; Farhar et al. 1980] about nuclear risks, it is 
likely that a major nuclear release will lead to irresistible demands for the 
shutdown of operating nuclear power plants and, perhaps, of military nuclear 
plants. In view of deep-seated public attitudes and the many wavs which a 
democracy offers for expressing them, this is not a trivial dimension of 
vulnerability: it means that a sizeable accident may lead to the loss not of 
one or two Gwe but of 50+ Gwe now and of any prospect of more later, to say 
nothing of political fallout in other countries. Conversely, Jenkins [1975:7] 
notes that public attitudes may be the most important motivation for terrorists 


to acquire nuclear dombs or attack nuclear plants: "...the primary attraction 
to terrorists in going nuclear is not that nuclear weapons would enable terror- 
ists to cause mass casualties, but rather that almost any terrorist action 
associated with the words ‘atomic’ or ‘nuclear’ would automatically generate 
fear in the minds of the public.” 

The technical and economic impact of the protracted disabling of any part 
of the nuclear fuel cycle would tend to be heightened by that cycle's intricate 
interdependence. Ic entails not just one but many complex operations whose 
logistical coordination has remained an elusive goal for several decades. One 


failure or dortleneck can have unexpected side-effects throughout the rest of 





the svstem. Just as reactors can become constipated if there is no place to 
store their spent fuel (a problem that has lately required the hasty "“densifi- 
cation” of many storage pools), or if there are not enough special casks in 
which to ship it elsewhere, so a reprocessing plant can become constipated if 
spent fuel arrives faster than technical breakdowns allow it to be handled. 
This is currently the cause of a serious and worsening problem at both the 
British and French plants for reprocessing fuel from graphite-moderated gas- 
cooled reactors. The magnesium-alloy cladding of that fuel corrodes in a 
matter of vears when stored (as it normally is) in water. Persistent problems 
at doth reprocessing plants “ave led to an increasing backlog of rotting fuel 
im storage pools. This increases operational problems and occupational haz- 
ards, leading to still more Sreakdowns. % Cp te a Hague, this cascading slow- 
down has diverted much of the capacity meant for handling oxide (LWR) fuel, 
incidentally so reducing the plutonium output that France must duv British 


plutonium to fuel the Super-Phénix fast reactor. 
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Should fuel cycles ever come to depend on reprocessing (as with breeder 
reactors), about 50 reactors would depend for their fuel on timely deliveries 
from a single reprocessing plant. At perhaps $3-8 billion each, such plants 
would be too costly to back up. (The several fuel-fabrication plants might 
2ffer a similar Ddottleneck.) Such fuel-cvcle dependencies clearly create a 
remarkable vulnerability: a single, otherwise minor reprocessing problem could 
idle some $100 billion worth of breeders. 

Although the sheer cost of replacing a major nuclear plant (or even 
cleaning up its remains) is probably less of an incentive to sabotage it than 
resulting releases, costs are not negligible. The extraordinary capital inten- 
sity of nuclear plants (new ones typically will cost several billion dollars 
each) does represent a risk to large blocks of invested capital, as Three Mile 
Island investors have discovered. Few if any utilities in the world have 
enough financial safety margin to absorb such a risk, and as Three Mile Island 
has again demonstrated, institutional preparedness for a multi-billion-dollar 
loss is also woefully inadequate. America's capital structure is already at 
risk because many utilities are insolvent, and their debt and equity--*he 
largest single block of paper assets in the whole economy--is the basis of many 
highly leveraged institutions. (How the insolvency arose and what to do about 
it are explored further in Appendix A.) Utility finance, and hence capital 
Markets generally, are currently so precarious--and likely to remain so for 
many vears--that another major loss could trigger cascading bankruptcies on a 
wholly unmanageable scale. The potential economic consequences of losing a 
Major nuclear asset thus go well beyond a particular utility or its ratepayers 
Or investors. Further, the financial community already perceives substantial 

isk associated with utility investments in general and nuclear-power invest- 
ments in particular [Emshwiller 1980,1981; Hershey 1981; Bupp 1981; O'Donnell 
1981; Marshall 198la; Parisi 1981; Shearson Loeb Rhoades Inc. 1981:4-9]. What 
long-term prospects for nuclear finance have survived Three Mile Island would 


certainly not survive a major episode of sabotage anywhere in the world. 


3.4.5. The added risk of auclear bombs. 


The foregoing assessment has mentioned only in passing that the risks 
described could be greatly increased by the direct and indirect consequences of 
nuclear explosions, even of low vield (kilotons or less). Unfortunately, the 
nuclear enterprise, both civil and militarv, increases the likelihood that 
nuclear bombs will become more widely available. Ignoring for simplicity the 


complex details which we have elsewhere treated and documented in detail 


[Lovins & Lovins 1980], this linkage has three main causes: 
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l. Every form of every fissionable material used in every nuclear fuel 


eT) 


cycle can be made, either directly or when treated with apparatus made widely 
available bw nuclear power, into formidable auclear bSombs--at least in the 
xiloton range. The other resources needed are available to almost any govern- 
ment, tO many nongovernmental groups, and to some able individuals. (Appendix 
53 is a technical assessment of expected explosive vields from plutonium as a 
function of isotopic composition, chemical form, and design sophistication.) 
Power reactors are themselves a peculiarly convenient tvpe of ailitary produc 
tion reactor, providing extremely large scale, zero political cost, amd almost 
nO marginal economic cost. The barriers supposedly posed by enrichment and 
reprocessing technology are not insuperable; even the coaversion of one fresh 
LWR fuel bundle into a dSomb’s worth of plutonium may be possible on a basement 
scale. There is no “cechnical fix" *. this problem, and no “political fix" 
short of global dictatorship. There is no prospect of adequate protection from 
any present or foreseeable means of monitoring, accounting for, physically 
protecting, and preventing governmental diversion of fissionable materials-- 
provided that fission (or perhaps fusion) technologies are in widespread use. 
Thus civil denuclearization is a necessary condition for nonproliferation. 

2. It is not only fissiomable materials that link reactors to bombs. Much 
of the equipment, knowledge, technical skill, and organizational structure 
essential for the former is also helpful for the latter. History suggests that 
this conmection can generate its own momentum through the evolution of techni- 
cal and commercial lobbies. These can become so powerful and self-contained 
that thev become a government unto themselves, evading (as in the 1950s British 
bomb program) or overturning (as in the French) established political controls. 

3. Perhaps the most important link is that nuclear power provides an in- 
nocent “cover” beneath which bomb programs can be readily concealed, and an 
ambiguity which invites latent proliferators to sidle up to the nuclear thres- 


nold bv degrees.* 





*Conversely, in a world without nuclear power, the materials, skills, and 
equipment needed to make bombs Sy any known method would no longer d5e items of 
commerce; efforts to get them would be more conspicuous; and being caught 
trving to get them would be politically far costlier to doth customer and 
supplier, because for the first time the intention would Se unambiguous! v 
militarv. Thus civil denuclearization is a largeiv (though s0¢f wholly) suffi- 
cient condition for nonproliferation. There are also intricate, reciprocal 
connections between vertical proliferation--the multiplication and refinement 
of bombs now possessed bv governmments--and horizontal proliferation to addi- 
tional parties. Neither of these problems can be consistently formulated or 
successfully addressed alone. These issues, and the problem of prolifera: ion 
generally, are bevond the scope of this studv, but are treated elsewhere 
[Lovins & Lovins 1980). 








ie Biel 


The resources needed to design and build a working nuclear bomb are highly 
VariaDle. As shown in Appendix 3, Dut to an extent greater than can de fully 
explained there, the sophistication of design and construction can varv enor- 
Touslv, depending on the ingenuity and resources available. Rule-of-thumb 
designs capable of being “thrown tcgerther™ with generous safety margins can de 
envisages and sight enter terrorist folklore. In general, official assessments 
tend to assume more sophistication than is actually needed; 5ut NRC's operating 
assumption [Gossick 1977] is that “sa smal! non-national group of people” coul3 


make a crude domb if thev had “the appropriate technical capabilities” and a 





formula quantity of fissionable material, (That is equivalent to 5 xg of highly 
enriched uranium-235 (HEU), similarly reactive amounts of medium-enriched 

235y, 2 kg of plutonium of any isotopic composition, or 2 kg of 233y, 

Some other usable materials, such as 237N», are not subject to safeguards. ) 

The NRC wisely does not give safeguards any credit for the fact that a larger- 
than-formula quantity would be needed in crude designs, nor for “the difficulty 
>r anv extended length of time involved in designing and fabricating” a bomb 


f 


_id.). (Taylor [1973:182] pointes out that even converting uranium or plutonium 
Nitrate to metal--an optional operation--is no more risky or difficult than 
converting morphine base to heroin, an operation that has been carried on 
routinely bw criminals in the south of France for manv years.) 

Regardless of ome's view about the resources and skills required, however, 
the plain fact is that anv threat of a clandestine domb which is competently 
enough framed to be technically credible is automatically credible. This is 
secause the skills and luck of those claiming to have the domb are unknown, and 
Secause they mav well have the fissionable material. This in turn is inescap- 
able decause the cumulative statistical uncertainty in U.S. inventories of bomb 
materials--the margin within which neither presence nor absence of the materi- 
als in their proper place can de confirmed--is about 20 tons, i.e. thousands of 


‘ a. te 


Sombs' worth, for HEU slone (O'Toole 1977), plus some more for plutonium and 
233y (141 xg for Savannah River plutonium alone | 3urnham 1980). [re is 

steadily increasing. ‘A sim‘lar situation prevaiis abroad, and bomb materials 
can be smuggled across national S5orders as easily as heroin.) Perhaps no dombd 


, 


material has Seen stolen; perhaps the Erwin emplovees who checked each other 
for theft under an honor svstem (Subcommittee on Energy & the Environment 
.9/7a:38) were all honorable; perhaps the NRC Dffice of Nuclear Materials and 
safeguards was Seing alarmist im proposing to revoke the Erwin plant's license 
. Surchan 979d); perhaps it is pure chance that as of January 1978 ei:azne of 


@ previous twelve inventory periods at Erwin had resulted in the iimit of 


error Deing exceeded NRC 1978!; perhaps, even though “a knowledgeable insider 














sould quite easily nave made off with" HEU from the Apollo plane in the 1960s 





y & the Environment 1979:7!, nobody bothered to; perhaps 
-f Is purely coincidental chart the statistical alarmbells in U.S. bomb-materi- 
als accounting have been ringing at least a third of the time [Marshall 19815}. 
Sut nobody can give an assurance that matters are so satisfactory. aAnvone who 
Slaims to dossess Somd material and seems t0 know what he or she is doing is 
nis consequence of the auclear age is irreversibdle. 

The coercive power of nuclear bombs is the dasis of their use dv Zgovern- 
Tents possessing them as a principal instrument of foreign policy. Mighe this 
same coercive power fall into other hands’? Some people, apparently meaning to 
De reassuring, have argued that terrorists would pass up nuclear bombs in favor 
>F other and perhaps simpler weapons of mass destruction, such as chlorine 
tankers (toxic at i5 parts per million) or pathogenic bacteria [Xupperman & 
Trent 1979:46]. These have in fact both been threatened by extortionists, and 
1f is true that anthrax spores, claimed in a German extortion attempt lid.], 
are tive orders of magnitude more toxic per gram than nerve gases and perhaps 
three orders of magnitude more lethal per gram than fissile material in crude 


.:357): their lethality could indeed "rival the effects of a thermnonu- 
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>lear device” (14.:46,65-68]. Burt i 


tnreats that explains why nuclear bomb threats have in fact outnumbered germ 
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darftare threats bv detter than twenty to one. ‘The existence of one vulnera 
Di.iftv in society, moreover, is not an argument for creating yet another, 


f fissiomable materials had actually been made into an illicit bomb, that 
-lassified. Between October 19790 and November 


9 in tne United States, nowever [3ass et al. 1980:55], there were 49 threat 


wessazes in which adversaries claimed to possess nuclear material or a nuclear 
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sanuary .9/9. Speciai procedures, evaluation teams, telephone numbers, etc. 
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Nave deen set up to deal with these threats, both at a Federal level and in 
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some States notably California). At least four threats were reportediv deemed 


rficient redidle to evoxe a high-level response, normaliv including an 
aten e sear : 2 $D0ecla instrumented tear Singer § weir 19°59 So far 
: > pus KNOWN, 2 tne tCoreats nave $0 far seen Siurts, ratner tnan 
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ated to a non-hoax nuclear threat and is implementing, in 
the guise of normal incremental policv shifts, concessions dictated by an 
onist. The degree of openness and public trust normally associated with 
governmental affairs, at least in the United States, makes this hypothesis seem 


cannot be altogether excluded; ard certainly there is a 
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ering air of suspicion about apparent efforts, as the Comptroller General 
2f the U.S. saw them, to block a ful! investigation of alleged thefts of bdomb 
material in the mid-1960s { Buranam 1979a]. 

ahat could a terrorist who actually possessed a nuclear bomb do with it 
Aside from obvious high-leverage targets*of a non-nuclear character (national 
monuments, centers of commerce, occasions on which many government officials 
are assembled, sports stadia, dams, refinery complexes, etc.), nuclear 
facilities offer a peculiarly attractive target because they can amplify the 
oOgical effects of even a small, crude bomb bv three to five orders of 
magnitude. Consider, for example, the effects of exploding a bomb near a power 
reactor. Chester & Chester [1976:329] state that cooling towers, without which 
the plant cannot operate, suffer heavy internal damage at about 2 psi overpres- 
sure, and wil ‘apse at about 3 psi. At about 12 psi, “damage to the con- 
trol room, auxiliary equipment, transformers, and water tanks will be so severe 


ikelv that even an uninjured emergency crew could pre- 


" The containment shell (for ice-condensing PWRs) 
will be “Sadly damaged" and the primary coolant loop will probably suffer minor 


io . . 


damage at adout 30 psi, causing a major release within hours. The pressure 


vw 


vesse. will rupture, releasing at least volatile fission products in minute 


ll these maximum overpressures are 
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orcer of 1000 or 109,000 tons of adjacent material, and nave typical firebali 
5 m and 180 a. 


Nese figures suggest that a major release can be guaranteed dv arranging 
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in the literature. On the contrary, sucn 


ted 
& Chester [1970,1974,1976] had considered relatively short- 


Ssive strategic attacks, so they naturally found that re- 


would not greatly increase the total destruction. Indeed, 


Ramberg [1980] nad thought seriously aout the whole prob- 
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S$ in wartime. A few countries operating power reactor 


heir territory--inadia, for example--witnhout involving the 


letnam, the 250-kWt TRIGA research reactor at Dalat was hastily 


cing American troops lest its radioactive core be released. 
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L was not considered a safeguards risk [Guardian 1975)}.) 
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re lixely, as a Finnish nuclear expert said, “In 


riteria tor safety of nuclear power stations would change. 


sue, nowever, is likely to de taken more seriously following the 


ing of lraq $s nuclear research center 
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Sagndad on 30 September 1950 [Boston Globe 1930; Marshall 
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able bombs mav be obtainable from stockpiles made bv the U.S. Department of 
energv. There are some 7000 assembled U.S. bombs stored just in Europe, manv 
small enough to tuck under one's arm*. One of them, set off near a nuclear 
facility, could spread as much fallout as a sizeable nuclear war. Nuclear fa- 


>ilities are thus such a high-leverage target that one must consider all routes 


UW 


vy which terrorists might obtain a bomb. Many analysts who, unlike us, con- 


vw 


ider homemade bombs improbable give a good deal more credence to stolen ones. 
Theft is certainly conceivable. Security, lax a decade ago, is still im 
perfect [Comptroller General of the U.S. 1980]. A respected analyst states 
. Barnaby 1975] that U.S. Army blackhat teams have successfully penetrated and 
left bomb storage Sunkers without detection despite armed guards and modern 
Darriers and alarms. Two incidents at a Nike Hercules base outside Baltimore 
suggest possible reconnaissance bv potential bomb thieves [O'Toole 1974]. In 
1979, journalist Joseph Albright testified [Dumas 1980:19] that by posing as a 
fencing contractor he gained an interior tour of two SAC bomb depots and their 
weak points: on 5 December 1977 he came "within a stone's throw of four...nu- 
clear weapons” while “riding about 5 mph in an Air Force pickup truck...driven 
dv mv only armed escort [with ome pistol, and both hands on the wheel....No 
yne] had searched me or inspected mv bulky briefcase, which was on my lap." 
Before publishing his article, he purchased bv mail blueprints showing the de- 
pots’ layout, a method of disabling the alarms, and two unguarded gates through 
the innermost security fence; afterwards he received a revised set showing "the 


wiring diagram for the solenoid locking system for the 8-52 alert area.’ 





stolen military bombs? Modern U.S. bombs--all those wit! 
lon Link (PAL) devices, which includes all those in Europe 
]- n allegedly be detonated only bv a proper numerical code, 
ing the wrong code irreversibly scrambles their electron- 

se ree questions unanswerable from open literature: 
- ts it true that PAL-equipped bombs cannot be set off without a currently 
auic-orized code, even bv the 50,000-odd people with up-to-date PAL training? 
DeNike (1975a] paraphrases Admiral La Rocque as stating that “existing PALs 
malfunction often enough during practice drills that getting around them has 
Se@come a regular practice. On any nuclear-armed U.S. Navy ship, there are four 
or five technicians trained to do this.” If so, PAL is not tamperproof. 
lv ts 
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- Can a military domb be careful dismantled so as to recover i core? 
And perhaps its other main components: anv arming and firing circuits, and 
ndeed everything else up to the detonators, could l d Sv an 


i be readilv replace 

not all U bombs apparently 
ir tores if tampered with. Secretary Schlesinger 
that “emergency destruction devices and proce- 
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e .ectronics experct. ) tv reasons, most t 
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$ 
stated in 1974 (Miller 
dures have been developed so that nuclear weapons may be destroved without pro- 
ing a nuclear vield in the event that enemy capture is threatened.” 3ut 
nat is clearly not the same as an automatic anti-tampering safeguard. 
- what are the corresponding safeguards in bombs made bv other countries? 
> 


It seems implausidle that some, specially developing countries, will have 
developed the elaborate and verv costly mechanisms used in nodern U.S. and 
British bomds for command, control, and overational safetv (inciuding one-point 
safety, whose develooment alone reported st dil ms of dollars 








The troublesome dimension which bomb stockpiles may add to existing 
merabilities is relevant here because the stockpiles have already 
experienced enough mishaps to make theft, unauthorized use, or accidental 
Jetonation seem plausible. The rate of officially acknowledged "Broken Arrows” 
(nuclear weapons accidents short of nuclear detonation) has so far averaged 


[Talbot & Dann 1981]. Over 


adout ome per year or several per thousand bombs 
J bombs are now stored in up to 200 sites in over 40 states [id.]. Fur- 
ther, some 3-4% of the 120,000 or so carefully screened military personnel who 
have the opportunity to detonate nuclear weapons must be replaced each vear-- 
nearly 5000 in 1976 alone [Aspin 1977]--for reasons ranging from drug abuse 
\about a third of the total) to mental problems to negligence. Some reports 
(Dumas 1980] suggest that such problems may be increasing, especially those 
related to drug use. An Army demolitions officer and seven Gis, all drug smug- 


lers, were arrested in Karlsruhe (coincidentally near a German nuclear re- 
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earch center with strategic inventories) after plotting arms thefts and a raid 


fe. | 


l office (id.]. February 1978 press reports describe a Georgia 


on an Army payrol 
zirwoman who broke and removed "four seals to the manual special weapons ter- 


l handle” ar 
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combat-ready 3-52 guarded bv soldiers with shoot-to-kill 
orders. French scientists testing a bomb in the Algerian Sahara apparently had 
to destrov it hurriedlv lest it fall into the hands of rebellious French gen- 
erals led by Maurice Challe [Brennan 1968], and during the Cultural Revolution 


in China, the military commander of Sinkiang Province reportedly threatened to 


take over the nuclear base there [id.]. Between theft, factions, unauthorized 
3se, accident, and horizontal proliferation, it is no wonder some analysts 


, with Admiral La Rocque [De Nike 1975a!, that “within ten vears, we'l 
see an atomic explosion unauthorized by a government.” 
These issues are raised not with the intention of opening up the vast 


¢t merely to point out that the combina- 


itv, frarlties, or temptations within the military could add up to disaster. A 
security system that could not detect a Klaus Fuchs at Los Alamos in wartime 


sould be hard oressed to detect an unstable airman at some remot? dase in 
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peacetime.  Secause nuclear facilities in the energy svstem can amplify the 
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This chapter has described some vulnerabilities of the energy systems on 
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Drojections of America’s energy future place major and 





increasing reliance: oil, gas (including LNG and L?G), swnfuels, and nuclear and 





power stations and their grids. These specific vulnerabili- 


2, are inherent in the nature of 
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zeneric ones surveved in Chapter 





the technologies. Some of the risks we have described may at first seem far- 





fetched-- just as the hijacking of three jumbo jets to the Middle East in one 


week seemed implausible until it happened. Sut given the consequences, no one 
would wish to be in the position [Drobnick & Enzer 1981! of the British intelli- 
7 


fter 47 vears' service, reminisced: 


ro 


gence officer who, om retiring in 1950 
"Year after year the worriers and fretters would come to me with awful predic- 
tions of the outbreak of war. I denied it each time. I was only wrong twice.” 
In the coming decades, salient trends that can reasonably be expected to 
persist or intensifv include: the nuclear and conventional arms races, East- 
ries, North-South inequities and conflicts, global political fragmen- 
tation (often expressed as terrorism), domestic tensions and political polari- 


zation, unemplovment, inflation, financial and climatic instability, and doubts 


environment of uncertainty, surprises, unrest, and possible violence, an energy 
svstem with Duilt-in vulnerabilities to all these kinds of disturDdDances is a 


deakness we can no longer afford. Still less can we afford energy technologies 


liver enerev in these conditions--with all 
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that implies for the potential sf catastropnic breakdown in the comity and 
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lf a central tenet of aational policv is to avoid placing ourselves in the 
position of having to choose detween vital national interests, such unavoidably 
vulneradle2 energy svstems are singularly unappealing unless there is absolutely 
No alternative. Happily, there are tecnnologies and energy systems which not 
DnNiv are .2@$s$ vulnerable to all kinds of failures, foreseeadle or rot, Sut 
ease, and attractiveness. w#¢ 


Tan choose technoicgzies chat safeguard both national security and the supreme 


_ . _*-- * ~ * ‘ ~ «-_ = + & , . 
§ wie 27006128. 43 4 34318 fOr Geve.ogpinz 


4 


i adour the vitality and reliability of global life-support systems. In such an 
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+. DESIGNING FOR RESILIENCE 





-l. Resilience versus reliability. 





, 


As we noted at the end of Chapter 1, efforts to maxe the energy svstem 
r2liable seek to enable it to withstand, or at least to make tolerably infre- 


quent, calculable, predicrable kinds of technical failure. But Chapters 2 and 





Nave catalogued many incalculable, unpredictable kinds of disruption--by 
Natural disaster, technical failure, or m licious intervention--which most of 
today $s energy systems cannot withstand and were not designed to withstand. 
These svstems were designed rather to work with acceptable reliability in what 
Alfvén (1972) calls a “technological paradise,” where evervthing happens 
according to the blueprints. If such a place has ever existed, the world 
emerging in the coming decades is certainly not it. 
raditional analyses of the reliability of energy supplies have sought to 
assess the probability and consequences of failure. Too often, the probability 
cannot de calculated, and the consequences either are plainly unacceptable or 
cannot be adequately measured Sv such traditional measures as degree of degrad- 
ation, jsirect economic losses, duration and difficulty of restoration, etc. 
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eductionist taxonomies ha 


rv 
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sought to classify how svstems can 


ve 
fail. One, for example [Manly ec al. 1970:100-103], classifies the “vulnera- 


tlitv™ of a local economy to disruptions in its control, process, input, and 


U 


Sutput. Each of these in turn can suffer “principal physical losses," “network 
" Al 


Jegradation,” or “disruption from other losses or imbalances,” each of many 


forth. But while this is analvtically elegant, it offers no clue 
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to how to design svstems so they are not so vulnerable in the first place. 

The vulnerabilities of complex svstems often cannot be foreseen in detail. 
A decade ago, intensive efforts sought to identify and to calculate the adso- 
Lute probability of various kinds of failures in hundreds of aerospace svstens 


_Brvan 1974; Comptroller Gener | of the U.S. 1974]. While some useful insights 


v 
" 
v 
3 
a 


into the relative reliability of diff Jesigns did emerge, the absolute es- 
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cimates wildly understated the actual failure rates. Faultetree and event-tree 


7 teil. , ; ~A Ann 
tetnods seedicted, for example, a failure rate of one ser 19,000 missions in 
- . ‘ . - t 
che fourth-staze Adol!ls ergine, Sut the actual rate was about four per hundred. 
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unless they are severely truncated dv assuming that enormous numbers of unana- 


lyzed Dut allegedliv “insignificant™ terms are collectively insignificant. 38ut 





in practice, many, perhaps most, accidents follow these umexamined sequences. 
Another reason such analyses omit manv actual causes of failure its that 
they assume complete knowledge. Design or fabrication errors which have not 
yet Seen discovered camnot be taken into account. Yet such errors caused a 
large fraction of the test failures in the Atlas missile program, about half 
the safety recalls of seven million U.S. cars in 1973, amd a significant frac- 
Cion of reactor mishaps. <A recent review of 32 major accidents in reactors, 
aircraft, ships, trains, etc. [Solomon & Salem 1980] noted pervasive gaps in 
xnowledge about the failure modes’ identity, significance, consequences, like- 
lihood, physical phenomenology, initiating events, and interaction with other 
factors (operating and maintenance errors, multiple random component failures, 
external events, etc.). So much is inevitably unknown that precautions against 
failure must be general enough to prevent failure modes that cannot be specifi- 


cally identified in advance. Such precautions must embody resilience in the 





desizn philosophy, not merely reliability in the design details. 


"= 





Large-scale failures which are physically possible will occur sooner or 
later as the passage of time tests all combinations of circumstances, probing 


for weaknesses. So manv “vanishingly improbable” failures are possible that 





ome or another of them is quite probable in a given year. Our foreknowledge of 
failure is limited only bv the fertility of our imaginations, but the limits of 
Sur imagination do not affect what happens--only our degree of astonishment. 
Traditionally, people have coped with inadequate knowledge by trial and 
error. But in the modern energy system, the cost of failure is so high that we 
Jare not do this. The impossibility of foreseeing and forestalling all major 
failures to which the modern energy svstem is vulnerable--of preventing all 
Surorises--requires that we take a different tack: learning to manage surprises 
and make them tolerable. This requires [Holling et al. 1979:2] an analysis of 
the umexpected: “of the sources of surprise, the perception of surprise and the 
response to surprise. From that, together with better understanding, come the 
Possidilities of designs and developments that can absorb and benefit from 


surprise. For example, rather than just making Con Ed's switching relavs more 


~*~ 


reliable in order to prevent an exact repetition of vast catastropnic gri 


Ta@llure®s, this approach would seek to make the arid resiliente-to make such 





failures structurallv impossible, regardless of the initiating event, the se- 
quence of failures, and whether or not thev were foreseen. Equivalentiv, a 
Strategy of resilience could seek to ensure that if complete grid failure did 
pCour, ifs CoNMsequences £0 energy users would de trivial 
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+.2. Passive versus active resilience. 





This sought-after quality of “resilience” is difficult to define. The 


word is commonly used to refer only to what Kahn [1978:3] calls “abilityv...to 


ithstand large exogenous [i.e. caused from outside] disturbances. The usua 
power svstem planning framework does not address itself to che occurrence of 


Srougnhts, coal strixes or major inter-regional suppiv deficiencies. The abili- 


tv to absord such shocks gracefully has been called the ‘resilience’ of a sys- 
tem." But “resilience,” he continues [:19], "...incorporates both a passive, 


Dehavioral notion and an active feedback control notion. A resilient system 


adDsords shock more easily than a ‘rigid’ system;™ that is, when stressed it 
Zives wav gracefully without shattering. “This is a passive characterization. 
But the]...corrective response to disturbance is an active control notion. 
in the case of power systems, the corrective response ultimately involves the 
political economy in which the [rechnical] system is embedded. Regulatory 
agencies institute investigations of major disturbances and initiate action to 
reinforce perceived weaknesses." Thus passive resilience is mere ability to 
Dounce without breaking; active resilience also connotes the adaptive quality 
of learning and profiting from stress by using it as a source of information to 
increase “bounciness” still further. In the snirit of this metaphor, a rubber ball 
Nas passive resilience; the nerves and muscles of someone learning to plav 
Dasketdall have active resilience. Energy svstems seed doth, but most 
currently have neither. 

Kahn (1978!) provides one of the few quantitative analyses of passive 
, 


resilience bv comparing the reliability of electrical supply from two hypothe- 


tical grids: ome powered mainly bv central thermal plants, the other by win 


curdines. For simplicitv, the role of transmission and distribution systems 
is ignored in both cases.) Kahn focuses not on the relative size or dispersion 


»f the power plants Dut rather on their reliability statistics--their “control- 


, " P 


Ladilitv™ or intermittence. On simplified and probably conservative assump- 
tions (favoring the steam plants), the two systems can be made equally reliable 
if the wind-dominated system is given slightly more storage capacity. 


Kahn then asks net what might de the probabilities of various detailed 
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failure modes, as traditional reliability analvsts would do--the ‘highiv speci- 
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Sieg network anmalvsis and contingency enumeration approach (:19,°-5ut rather 
Now the re.iadi. itv of these two systems #Ou.d cnange if eacn Cvoe of genera~ 
? " - = 
fiom worked .@8s re.iadiv than expectec je perturdSs the system sv assuming 
worse performance a1. arounc, such as Tight Se@ caused Sv a Coa. StTice, 3 
‘ . ‘ , 4 
embargo, generic nuclear shutdown, drought, cloudy or windless period, ets. 
r" = | a * 
. ~*~ | - ~ © . ~ -~ “— - . . ~ - 7 | 4 
" ie aoso.4 ite amc sei . iS 3u! ec 2e2f acact: n > .ne same ge) 4 DOEA ercids, out ia 








137 
percentage terms it affects wind less than central-station generators because 
the wind generators are already more subject to fluctuations: they are already 


intermittent and cannot get much more so. Their grid was designed to cope with 





fluctuation and has “bitten the bullet” by providing adequate windpower and 
storage capacity. But an equal amount of increase in the failure rate, whatev- 
er ifs cause, is far more serious for the central-station system, which was 
designed on the assumption of high reliability and rapidly breaks down without 
it. From the dispatcher's point of view, degrading reliability bv 10% or more 
makes the central-station grid about five times less reliable than the wind- 
Dased grid. The central plants’ storage or backup requirements to maintain 
equal reliability zoom up far more steeply and to much higher levels than those 
of similarly degraded wind plants. (Alternatively, if the reliability require- 
ments were somewhat relaxed, the renewable grid could take more additional load 
than the central-station grid [:20], or equivalently would show a greater sav- 
ing in backup or storage capacity.) This “supports the thesis associated with 
Lovins that the intermittent [sources]...produce a more resilient system" [:3]. 
Kann thus finds [1979:343-344] chat “the impact of unusual or extreme 
circumstances...modelled as extra [statistical] variance or uncertainty...[is! 
smaller...on the wind energy system than on the conventional one...[showing] a 
greater ability to absorb risk." He cites [id.] similar conclusions in the 
power-svstem control-theoretic literature and in a Sritish wind-energy analysis 
by the Astronomer Royal, Sir Martin Ryle ([1977]. Sir Martin's design for a 
British wind system was more resilient than that of the Central Electricity 
Generating Board [Leicester et al. 1978; Anderson et al. 1978] because it sac- 
rificed a little performance at high windspeeds in order to be able to operate 
at low omnes, and therefore could work most of the time. In a long period of low 
windspeed, Sir Martin's design would still produce power much of the time, while 
the CEGB's overdesigned machines would produce none at all, requiring over five 
cimes as much storage. The more “resilient svstem minimizes the impact of ex- 


” * 


treme conditions.... Such resilience “has important consequences. It means 
...that exogenous uncertainties...have already deen duilt into the system. 
Therefore the impact of the marginal risk goes down." 

Passively resilient energy systems offer no benefit unless used. The 
process of learning to use them is a kind of active resilience. Biological 
svstems have this learning and corrective process Suilt in. [ft provides the 
adaptability that has carried these svstems through several Dillion vears in 
#hicn environmental stresses were so great that all designs lacking resilience 
were recalied Sy the Manufacturer and are therefore no longer around to de 
studied. To understand active resilience so that we can apply it to the design 
9f energy svstems, we need t> examine the archite 


that have survived the exacting test of evolution. 
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This is a central theme of several provocative articles bw the Canadian 
ecologist C.S. Holling. He describes many instances in which the learning 
ities of an. ecosystem, not just its passive “safety margins™ or its redun- 
Jancy (like having an extra kidney), enable it to emerge strengthened dy having 
experienced stress. Holling's arguments about DdDiologica! resilience are framed 
in the language of abstract mathematics*, but at the cost of losing some of his 
sudtler insights, we shall summarize them here in ordinary terms. 


+.3. Resilience in biological svstems. 





Our earlier discussion (pages 17-18 above) of the Borneo and Canete Valley 
ecosystems found that whe: th v were disturbed, unforeseen interlinkages with- 
in them made them lose their ecological stability. “Stability” in this sense 
does not mean a static equilibrium, but rather the ability of a system to 
regulate itself so that normal fluctuations in its populations of plants and 
animals do not reach the point of either extinction or plague. The system does 
not remain exactly the same--it is free to vary--but it varies only within one 
zeneral mode of dehavior that is recognizable and coherent. 

Self-regulation that works only so far is common in biological systems. As 
Garrett Hardin has pointed out [Holling & Goldberg 1971:225; emphasis added], 
our bodies regulate their own temperature at about 98.6°F. “If through sick- 
ness or...dramatic changes in external temperature, the body temperature begins 
to rie or fall, then negative feedback processes bring [it] back to the equi- 
librium level. 3But...this regulation occurs only within limits. If the dody 
temperature is forced too high...the excessive heat input defeats the regula- 
tiom,...[ increasing] metabolism which produces more heat, which produces higher 
temperatures, and so on. The result is death. The same happens if temperature 
drops below a critical boundary. We see, therefore, even in this simple svs- 
tem, that stability relates noe just to the equilidrium point but to the domain 


of temperatures over which true temperature regulation can occur. If is (the 





breadth of] this domain of stability that is the measure of resilience.’ 








h of mathematics known as “catastrophe theorv"” [Thom 1975; 


*A new DSranc 

Stewart 1975; Woodcock & Davis 1978) deals with discontinuous changes in the 
state of compiex systems. [It is able to classify these changes--which can 5e, 
for example, onlv of seven dSasic kinds in a svstem controlled 5v four variables 
ewmwand can describe them dv geometrical analogies. Strictlv speaking, the 


stvie of mathematics is more that of topology, which deais with the most zener- 


al properties of geometric forms, such as how manv holes thev nave through 
them, without deing concerned with their exact size or shape.) Holling'’s re- 


suits do not rely on the theorems of catastrophe theory, Sut do borrow some of 
lts cemminology. Readers with good mathematical intuition are urged to read 
Holling in the original (1978; Holling ee al. 1979;. 
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More complex svstems with more variables also have their domains of stable 
self-regulation bevornd which chev break down. Regardless of the degree of com 
plexity, successful (i.e. surviving) ecosystems “are those that have evolved 


tactics to keep the domain of stabilitv, or resilience, broad enough to absord 





the consequences of charge.” [Holling & Goldberg 1971:225; emphasis added! 





These svstems do 72e attain the absolute pinnacle of biological efficiency in 
capturing available energy, but by avoiding the extreme specialization this 


ould require, thev also avoid the risk of “contraction of the boundaries of 


‘ 
. 


stability"--a reduced margin of adaptability. 

Holling [1978:99-104] describes several possible ways to view these 
“domains of stability” and hence to judge the resilience of an ecosystem. For 
example, one mathematically simple and politically comforting view, widelv held 
dv non-Ddiologists, is taat the domains of stability are infinitely large--that 


nature is infinitely resilient, tolerant, and forgiving. In this view, no 





matter how drastically a system is disturbed, it will always bounce back. 

An opposing view holds that nature is so delicately balanced that the 
domains of stability are infinitely small, so that anv slight disturbance will 
lead to extinction. If this were literally true, hardly anvthing would by now 
be left alive. Sut this view is not so indefensible if applied only locally, 
not globally, because then temporary extinction in one place can de made up dy 
recolonization from adjacent areas. Some classical experiments in population 
biology illustrate this process. For example, if two kinds of mites, one eat- 
ing plants and the other eating the first kind of mite, are confined within a 
small area, both the predator and the prey populations will drop to zero as 
their oscillating interactions outrun their respective food supplies. Sut if 
the enclosure is divided bv “arriers into sub-regions, between which either 
kind of mite can move with some delav and difficultyv, then since the population 
cycle of outbreak and collapse proceeds at slightlv (and randomly) different 
rates in different sud-regions, both the predator mites and their prev can 
recolonize from surplus to deficit areas. This ensures the survival of both 


species someplace in the enclosure. That experiment illustrates the important 


comciusion that if domains of stability are small--if ; seem is fragile--it 
will Senefirc from deing fine-grained and heterogeneo: pace. Failure then 
Joes Not propagate and can de repaired from areas still functioning. Local 


Dackup, iocal autonomv, and a preference for smali over large scale ang for 
iversity over homogeneity all increase resilience in such cases. 

A possidile view precisely between the extremes of supposing nature to 5e 
infinitely brittle or infinitely resilient is the view that the behavior of 


ecosystems is Neutral, tending toward neither stabilitv nor instability 


neither endangered nor protects4 Sv zeneral features of system architecture. 
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2ifferential ecuafions common!v used to represent the interactions 


ations embody this view bw assuming that the populations can 


Mathematicallw convenient but greatly oversimplified. If it !s refined dv 


adding anv «ind of negative feedback (for example, that population outdreaxs 


w 
vY 
, ied 
v 


sill de constrained bv crowding effects), then collapse Ddecomes impos 
the other nand, adding anv kind of positive feedback, or time lags in respondc- 


‘, 


img tO everts, creates instadilitv and makes collapse inevicable. Yet borch 


Zative and positive feedbacks actually exist in real ecosvstems, leading to a 





MIX Of stadilizing and destabilizing properties whose relative dominance varies 


im time and space. It is the dSalance of these stabilizing and destabilizing 





forces that enables ecosystems to regulate themselves into a semblance of 





stadilitve-orovided they are not pushed too far, into a region of Sehavior 





where the instabilities dominate and cause coilapse. 
in all Sut perhaps the simplest ecosvstems, these sathematical properties 
create (as Soth theory and experiment confirm) not 


tv, or region of equilibrium DSehavior, Sut multiple domains of stabilitv. Each 





represents a “basin™ within which the behavior of the svstem can “slop around” 
without dramatic change. Sut if some variable import7nc to the svstem's dSeha- 
vior exceeds (‘ts range of stable values, the system can abruptiv change into a 


different © -jia™ o 


--* 
rw 


behavior bv “slopping up over” the “ridge” between ad ja- 


cent “Sasias." Eutrophication of a pond is such a charge. If more and more 


Nutrients (e.2. phosphates) are added to the water, eventually its limits of 


, 


t will suddenly develop an alga! Sloom, which can 


still be veached. 4 


lead to rotting of the plant matter and the irreversibdle creation o 


ey, 


anerobic 


conditions. The pond can then aot support its original species or perhaps anv 
sthers. Similarly aSrupt transitions, triggered Sv seemingiv small disturdan- 


res t2> critical variadles, can apparent!iv cccur in marine Siology (Platt e 





} 1o°° ; ’ , al; ° ’ 7 as : 5 ae’ a * 
ai. iy , im glodal climate (Lorenz 19°59:, and even in political and economi-< 
——_——— 
suvatame . _ * & "> * “ea ; eave’ ut A aA ‘ , 7 “ae alweee ) 
svecens a5 the Great Depression, voLlutions, and similsr catacivsrs 

sa : - . 
if ecosvstems have multiple domains of stability and can be easily trig- 
gerec to switch from one to another, the strategy for avoiding such a transio 
’ " " ? . 
fiom is ¢) stav far awav from the ridge separating one domain or dSasin’ of 
staDbDi.sitv from tre sexe. This is precisely, as 4olling (_1978:102£) romarxs, 

e the Ria? resaonsidle tradition of engineering for safety, of nuclear 
safeguaris, of environmental and health standards.” 3ut, t9 add emphasis, this 
a>proacs semands and sores umes krcwledze. ie woens Seagutifuliv if the svstem 
1$ simple and known--sav, the desian of Solts f5r an aircraft. ,nen the stress 

- . ~ ” - 4 . ~ 4 ok ~ . ‘ ~ ~ ‘~~ * 4 > *h . "os 

sc 2 .°at eid, these 3 3 e treated as chev a 
getatic, and the Seit can Se cserafted so that normal of ever adnorma. stresses 
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can Se absorbed. The goal is to minimize the probability of failure. And in 
that, the approach has succeeded. 3ut in parallel with that achievement is a 
Nigh cost of failure--the verv issue that now makes trial-and-error methods of 


tealing with the unknown so dangerous. Far from being resilient solutions, 





thev seem to 5e the opposite, when applied to large svstems that are onlv 





Dartiallvy known. To be able to identifv...[safe limits]...presumes sufficient 





a) ; g 
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<nowledge. Thus the engineering-for-safety approach “emphasizes a fail-safe 
Sesign at the price of a safe-fail one.” If the inner workings of a svstem are 
not perfectliv understood and predictable, efforts to remain within its domain 
>f stadilitw mav fail, leading not to safetv but to collapse. 


worse, because the hidden processes and parameters that determine the size 


Vv 
wy 


that domain are continually (if slowly) changing in time, and because thev 
Mav interact with outside influences in wavs that mav not be perceived in 
acvance, changing the values of xey parameters in a well-meant effort to 
ensure safety mav actually create new dangers. Intervention can “shrink"™ or 
even “implode” domains of stabilitv, throwing the system unexpectedly into 
anstabdle or catastrophic behavior nodes-- just as spraying pesticides in the 
canete Vallev made a previously resilient ecosvstem too brittle to cope with 
uctuations in growing conditions. 

If the position of each stability boundary could be perfectly known and 
the distance to it monitored and controlled, safetv might »e possible. But in 
the absence of perfect knowledge, efforts at such control are more likely to 
shrink the domain of stability and to shift its dSoundaries in unexpected cirec- 
tions. The wHO thought it was using safe levels of DDT in Borneo, but not that 
chis intervention, focused on providing a narrow form of safety--eradication of 
malaria--would so destabilize other interactive predator-prey relationships as 
to result im plague. “This dynamic pattern of the variables of the system and 
9f its basic stability structure,” writes Holling (1978:104], “lies at the 
seart of coping with the unknown.” 


Striving merely for passive resilience--"the property that allows a svstem 


—" 


to absordS change and still sersist"--means striving to stay away from the boun- 


Jaries of stability. Yet as interventions and environmental changes constantly 


°? 
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shift those Soundaries, actions that used ty be stabilizing may Secome destadi- 


zing, anr¢ far-off Soundaries tav Secome rear or de transgressed. A strategy 
mindfu. of the limits of «knowledge, therefore, is to strive for active resili- 
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encees 4 property that a.lows 4 system £9 adsord and utilize (or even Senerit 
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experienced defore.” The spravers' mental model has one element--that spraying 


<:lls budworms, which eat trees, which are worth money--whereas even the simp- 
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Second, they mav trv to extend the doundaries of definition of the 
Natural system, so as to include “all relevant factors” in their analyses 
._via elaborate mode!s and large interdisciplinary research zroups--an 
approach equally doomed to failure but slower to appreciate if).... 

Third, they may simply try to find ways to live with high variability. 
There are at least two design possidilities for living with surprise. 
First, the insticution may attempt to design some means to stabilize 
system outputs without stabilizing svstem states, by finding some way to 
store up outputs and release them in a more or less steady stream. Indivi- 
duals nedge against uncertainty by storing money in savings accounts; dams 
store water for release in drv periods....This design approach is the most 
Dromising, in terms of social acceptability, that we have uncovered so far. 
Finally, the institutions may attempt to spread risks dy disaggregating the 

- 


system into ‘operational units,’ each with a relatively low cost of failure 
and minimally interdependent on each other]....For example,...the energy 
planner must be able to design parallel development...options...such that 
failure of one does not drag the others down also. 


Sudsequent Chapters will expand on these last two approaches--smoothing and dis- 
aggregating energy supplies. They are indeed the “most promising” approaches 
a 


King tolerable those surprises that cannot be reduced to expectations. 





Designers of aircraft, reactors, military hardware, water and telecommuni- 
cations systems, etc. have long sought to achieve at least passive resilience-- 
to avoid the “brittleness” of svstems that shatter if stressed beyond their 
limits. In this quest thev have developed by trial and error a number of tacit 


" because few have deen written down. 


fee " 


we say tacit 
classic texts of reactor engineering [e.g. Thompson & Beckerley 1964-70] have 
Tar more to say about specific design embodiments which may be resilient chan 
adDout the general principles of formulating such designs, and even such acknow= 


ledged experts in resilient design as F.R. Farmer and S. Hanauer do not seem to 


Jave formalized their extensive design experience.) These principles mirror 





tnose used in Diological organization to achieve active resilience. 

The elements of resilient desizn can be described qualitatively, but are 
exceedingly difficult to pin down in numbers. They are also not all mutually 
consistent and compatible, so some compromises between them are necessary--a 
process with which living things are not yet fully satisfied after several 


Silliom years, so it will doubtless take human analysts quite a while too. 


™ Pod . --A~ be =f -" _ : ie | a - _ ‘ec + ) } To | 
Jeferring to Chapter 5 the fuller discussion of issues reiated to the scale and 
secentralization of tndividual tomponents of the enerzy svstem, we consider ere 


the Sroad principles of dispersion, umerical redundancy, 


dJiversity, interconnection, functional flexibility, modularity, standardization, 
’ a 2 4 re a4 7 = > 2 “ - 

internal decoupiing and buffering, simplicity, forgivingness, reproducidi.itv, 
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speed of evolution, accessibility, and socia smparcidility. 
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ailv identical but phvsically verv different sudDsvstems. A specific example 
wou.c de coupling inertial guidance, fluidic, and electronic subsystems into the 
guidance system of a missile. Destruction of the electronic components by a 
meardv intense radiation field would not damage the purely mechanical compon- 
ents, permitting the function to continue. Although this example is not a happy 
2ne £9 contemplate, it demonstrates (that! where svstems are considered by their 
sesizgners to have to succeed in the face of multiple assaults, techniques for 
>reating a high degree of resilience have been used.” (Weingart 1977:29) 

Ir is on the principle of functional redundancy that nuclear reactors shut 
gown if anv of several signals is abnormal (e.z. neutron flux, temperature, or 
period); Sut translating that shutdown command into action mav fail for lack of 
Siversit Most reactor shutdown svstems in the U.S. rely on continued elec- 
tric Supplies from the plant busses. In contrast, Sritish practice favors 
manv functionally redundant snutdown devices, relying perhaps on centrally 
powered electrical devices in ome case, local Sattervy power in another, gravity 
If springs in another, and local compressed-air Sottles in vet another. This 
Siversitv is sought quite deliberately, on the principle that one’s inability to 
think of a failure mode for a particular svstem does not mean the system cannot 
come up with one, so having svstems as different as possidle mav help in some 
infsreseen way td protect against common-mode failure*® Likewise, an important 
mot Ti ee speaking, mmon@enode failures can Se distinguished from -sommon- 

ause faliures _*olomon & Saiem 195 The former refer to the faiiure of idene 
> -al, sumerical redgunegant moonents mn te game wav ‘wt >» .ne atter rerers 
< a failure of functionally redundant svstems from 4a common initiating event 
ALchougn our argument does not depend on this sometimes orced distinction, S5oth 
<inds of fa: res *ene 2 sav reactor accidents *3 Se more mportant enan 
Fancom, sequential fa res Fr $19@.2@ e¢omoonents ~.OTMmON-Mode fali.zures Neec not 
se purely technological: the same politica! trends could simultaneousl: srevent 
vestern COG es ‘73 Se > re Pe sGSe @ Owe T= ant. waver, und JF ana ae pro éc 3 
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, functional redundancy can appear to be an operational 
Nuisance. In graphite-moderated reactors, for esample, some tvpes of accidents 
might distort the core so that control rods can no longer be fullv inserted. In 


the newer British reactors, an emergency shutdown system known as the "O Jesus” 
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thougnhtiessly or accidentallv. In contrast, the Fort St. Vrain reactor in 
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.>. electric transmission and distridution svstems iack this propertv: their a 





morma..v .ose is their own call, not evervone s at once Yet as able, computer- 
@guinpes “rommunications hobbvists” probe these vulnerabilities, out of malice 
2 Ber? curitositv, we mav all become more aware that the routing flexibility of 
cre Zell Svstem is tot aS invulnerable as it looks. If is an open question 
ghether the apparent flexibilitwv of routing in major electric grids is equally 
valmeradie 25 Sisruption of a few xey nodes. Although some odservers think sot 
.@.z. Joint Committee on Defense Production 1977a:72-73,lie-ll7], it is noe 
>.@ar that thev have thought verv hard about it 
Re lated t9 functional redundancy, and often reliant on interconnection, is 
the property of functional flexibility. The human dodv provides numerically 
redundant xidnevs, lungs, etc., plus considerable spare capacity in the liver 
anc heart, dbut there is only one spleen. No matter: if the spleen is lost, 
Sertain structures in the liver are sufficiently similar that the liver can 
gradually take over the spleen's essential functions [Altman 19860]. That is, 
aithough tof meant to de a spleen, the liver is designed to pinch-hit for it. 
This is the concept dsehind the Swedish requirement that new boilers be able to 
accept solid fuel (roal, wood, etc.) and the recent Swedish government discus- 
$ioms on whether to stockpile wood gasifiers for emergency operation of cars--a 
znliv developed art that ran a million motor vehicles during world war [!I. 
Wot comtent with requiring doiler operators and other principal energy users to 
Maintain orivate stockpiles amounting in practice to about 0.3 vears’ fuel 
suppiv, the Swedish government is already thinking about pinch-hitting technol 
gies The same principle presumadly guides U.S. planners’ Multi-Fuel Prograa 
Take? 3 tary venicles adaptable t5 a wider range of emergency fuel supplies--a 
-.@xi3 ev ft Third Reicn found essential, equipping bv March 1944 more than 
- Sf Large vehicles to burn alternative liquid, gaseous, and solid fuels 
enerav & Defense Project 1990:23,. Such flexibility can apply to doth energy 
; iv amd gemand, and Chapter 6 w illustrate how more efficient energy use 
an: sprovised ies vast nore useful. 
Modularity and standardization see doudle-edged properties: on the one 
nd, the ad ty to plug in common replacement parts can make equipment far 
mor Ainta isle, Sut on the other, if the modules happen to incorporate a 
s'2 r tanufaceturing flaw, that flaw is then plugged in universaliv--as “as 
rrad @i° rtain automobiie spar arcs Special ir s thus essentia 
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refinerv, for example, which has verv small storage tanks in Detween its stages 
has 20 operational flexibility: if all scages do not work exactiv at the rate 
and in the manner planned, products will be too scarce at some doints and t90 
Dlentiful at others. If ome stage fails, there will also be no way to bypass it 
and no Sreathing space’ of time in which ¢5 improvise repairs, so the whole 
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inoperable was that it was too tightly coupled to allow for normal operational 
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sense of the tangible importance of a large refinery or power plant. Yet in a 
teenver sense, the success of the free-market economic philosophy on which 
American private enterprise has deen Suilt depends very directly on the speed 
and efficiency of many individually small decisions by sovereign consumers. It 
is precisely because those decisions work faster, better, and more accurately in 
Ziving practical effect to private preferences that Americans have opted for a 
market svstem--one of decentralized choice and action--rather than for a 
centrally planned economy on the Soviet model. And in energy policy, this 
selection has been rewarded; for todav those individual decisions in the market- 
place--decisions to use energy more efficientlvy--are, in aggregate, affecting 
rhe national energy picture two orders of magnitude faster than ail the diz 
supply projects put together. (We shall offer data to this effect below. 
Despite this success, manv energy planners are reluctant to rest their 
l actions--decause such actions are not under the 


as a large construction project is (or is supposed to 
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be). Yet exactly the same mechanisms are at work in individuals’ small actions 
[Oo increase their energy efficiency that have always been invoked as the ration- 
aie for forecasting growth in energy demand. The countless small market deci- 
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Zy savings are aot confined to space heating and cooling. A combination of 


water-erfficient appliances and recovery of waste heat from outzoing “gravywater 


(trom dishwashing, washing machines, showers, etc., but not including sewage) 
ly cut the water-heating load in half [Carter & Flower 1981]. Most 
1f noc all of these measures are cost-effective at the present world oil price, 
and all are cost-effective against electrical or synfuel prices. 

Intelligent redesign of household appliances can reduce their average use 
of electricity by three- to four-fold ([Noérgard 1979,1979a] with an average 
DaydDack time under 9 years at the present average U.S. residential electricity 
price--all with no change in performance or convenience. An average U.S. frost- 
free refrigerator, for example, uses about 1700 kW-h/y; Amana has a 675-kW-h/y 
prototype; the best 1981 Japanese models use about 400 (for the same size); 
under 200 its cost-effective today. 

The efficiency improvements that can be made in space heating and cooling, 
water heating, lights, and appliances are often even larger and cheaper in the 
commercial sector (offices, hotels, churches, schools, hospitals, etc.) than in 
houses. Many office buildings were designed to be cooled and heated simultan- 
eously, and most of their cooling load is to take away the heat of overlighting 
(i.e. at headache level). Just the difference in lighting intensity between 


) and in 1980 (2 W/ée 


Pe er : ; ) ‘ 12.3 
offices built in the early 1970s (about « W/fr¢ 


‘ 
’ 


WV 
+ 
' 


would by 2000 eliminate the need for 150 l-GWe power plants [SERI 1981: 
55]. The average U.S. office building in 1978 used over 340,000 BTU of total 
resource enerzyv, as direct fuels plus power-plant fuels, to space-condition, 

ot of floorspace. Hvdro Place, a glass 
utilitv headquarters in Toronto, uses 170,000; Gulf Canada Square in Calgarv, 
about 117,000; the best office buildings now nearing completion in Canada, 20- 
30,000. All these designs have payback times of a few years. 


So far we have described only new Suildings. But most of the duildings 





standing, $0 the main focus must be on retrofitting (fixing up) those existing 
- “ * p=) o ° : == ° e _ > ~ . 
stocks Extensive data are availabie ,SERI 1981; Carhart et al 80; on the 
: _A ’ - ~ 4 . - ~ _ mé, - * 7 -* ~~ _- - ; = » 3 4 
2mpirical cost and performance of retrofits. Most of the techniques descrided 


above can de applied, with minor modifications, to existing Duildings. Some 


eanadian builders remove the siding from a frame house, Dduii¢c out the eaves anc 


casings, add a vapor dSarrier and superinsulation, and put the siding Sack on, 








range of construction styles. 


ay 
— 
" 
© 


It is common in Europe ev 


insulation and a new facade on masonry walls, trapping their 


capacity or "thermal mass" inside and lizing the 


sO 


Even elaborate measures of this kind, in countries (such 
Germany) which have the world's highest labor costs, specific 


levels, and relatively efficient buildings 


Ww 





to start 


are cost-effective at present OPEC oil prices [Lovins, Lovins, Krause, 


1981:25]. 


- *» i 


nouses commercial buildings have cose about $1/frt- 


or 


In well-planned programs, retrofits to tighten and insulate 


about $6-7/bdb1 (15¢/zgal) of equivalent oil savings [SERI 1981:24-27,55). 


\ 


| 


cost applies for savings of more than two-thirds of the original average enerzy 


use. 


in houses rather than pressure-testing find hidden leaks, 


windows rather than insulating shades 


ments--cost about $19/bbl (40¢/zal) [SERI 1981 


with OPEC crude oil at $34/bbl, synfuel at $40-80/d01 ( 


assuming $34/>bl oil pr 


citv at $90-120/"bol" of heat content. 


Transportation. 


Two-thirds of America's transportation energy, and 


Oil use, zoes to cars. 


the light trucks nearer i2 improvements 


streamlining, and bearings 


to 
and other cost-effective 


over half 


=) 


Even sudoptimal programs--such as those which plug only visible 
or which 


window 


fa 


air 


leaks 


use storm 


treat 


9 
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in the engine and dr 


ive 


:1:27]--still highly competitive 
1979-$ piant-gate price 


ice) [Congressional Research Service 1981], or electri- 


Se 


The cars average about 16 miles per U.S. gallon (mpg), 


cam improve these fizures 


for a 4+-passenger car of about the same size and performance as 


the average 1981 domestic model [SERI 1981; Gray & von Hippel 198i; TRW 1979; 


Shackson & Leach i980]. The total cost of improvements to 60 mpe 
per car (|Shackson & Leach 1980; Gorman & Heitner 1980; SERI 1981 
ing to a pavydDack time, at the sresent gasoline price, between one 
tChree and analt years. 


Some Manufacturers are already well 


re road; ave 


diesel Rabbit” already averages about <0 mpg 


Japanese cars he road; Vw has prototyped a 


Rabbit™ which ing, meets all 


raze 


these goals. 
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accelerates 0-90 mph in 13.5 seconds, and is safe 
o a ;oen = ° 22 ~ 
9t America 1980 Most impressiveiv, an advanced 


" - eer yveae ~ = — ° 2 fF - -* 
composite efficiency of 380 mpg .Seifferrt & Walzer 


the EPA at 30 mpg city, 100 mpg highway. (On-road 


do not exhaust the possibilities offered bv series 
variaDle transmissions (being introduced in 1981-8 
It is important to note thar these 60-90 mpg 
sider another option--using cars more specialized 
2-seater commuter cars for the vast majority of pe 
are selling well in many other countries [Boyle 19 


motive News 1980], especially the Japanese "mini-c 





than +.5 by 10.5 feet and displacing no more than 
ing over 20% of the domestic market in highly urba 
tion is that some models get on-road efficiencies 
(In contrast, GM's newly announced diesel Chevette 
designs offer a good match to the urban driving ne 
with modern crushabdle-foam materials, can be safer 
ing commuter mini-carse into the fleet could send f 
Straigntrorward application of proven and cos 
reduce the specific energy requirements of heavy ¢t 


of railroads by about 25%. New Japanese ship desi 


in a +U-mph head-on crasna (Vw 


Va ci2sel prototype with a 


1980!--was recently tested dv 


mileage in real driving 


les will vrobdably average over 80 mpg.) Even these empirical achievements 


a bowel es 
hybrid drives, infinitelv 


y 


2 dv Borg-Warner/ fi 
achievements do not even con- 
for their tasks, notably 
rsonal driving. Such cars 


81; Lehner 1980; Japan Auto- 





'" measuring no bigger 


ars,’ 
550 cc, but currently captur- 
nized Japan. Their attrac- 
of 53 mpg city, 75 highway. 
gets only 40/55 mpg.) Such 
eds of many Americans, and 
than conventional cars. Mix- 
leet averages over 100 mpg. 
t-effective technology can 
rucks and buses bv 30-40% and 


gns have cost-effectively 


saved about 50% of normal fuel requirements. Commercial aircraft (7% of U.S. 


transportation fuel use) have improved their fleet 
zger niles per gallon in 1973 to 25 today and will 

tion of aircraft has been fully introduced (Boeing 
advanced L-l01ll)--a 45% improvement in fuel effici 
are available from new technologies for turbofan e 
wing designs, active control technoiogies, and wei 


er these promise a saving of about 70%. 


oe | — : , @abie Faced. 
0.1.3. Industry ,SERI 1981; Sane et a.. 1951, Lovan 


The ten most energy-intensive U.S. industries 
their energy consumption per unit of product Ov an 


Insider 198lj)~-almost entirely dv measures paving 





efficiency from 17.5 passen- 
reach 45 once the new zenera- 
757 and 767, DC9-60, and 
encyv. Even larger savings 
$ - 4 1 
Ngines, special propeller and 


ght-saving materials; togeth- 


during 1972-79 decreased 
average of 15.44 | Enera2v 


Sack within one or two vears 


- —» »} =) 1 ; a a wT ee; : ae - . ee@e2 
at the then current rolied@-in fuel srices. The efficiency of using process 
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neat (about 43% of all industrial energy) rose by about 4% per year. 3ut there 


is still ec 
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Saving act least a third more neat 5y oetter 
thermal insulation, heat recovery, process controls, neat pumps, cogeneration, 
and use of dest available processes. Alumina smelters can Likewise save at 


least a third of their electrical input by adopting superior processes ‘Alcoa, 
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roper sizing, coupling, and contr 
ectricity needs for industrial motors (27% of all industrial primary energy 
use); this one improvement, typically paying back in a few years, would more 
than displace every nuclear power plant in the country. Innovative industrial 
processes even more efficient than we have just stated are deing rapidly 
developed, such as a new process which saves over three-quarters of the enerzy 
needed to make ethylene. A substantial fraction of industrial enerzy can also 


be saved by more efficient use, recycling, and remanufacturing of materials. 


whether efficiency in each sector is improved all the way to these cost- 


effective levels or only partway, the improvement benefits energy resilience at 


the scale of both the user and the whole society. We consider these in turn. 


6.2. Micro bdenefits. 





Increased end-use efficiency decreases the vulnerability of energy users, 
at the scale of an individual household, office, shop, or factory, in four main 
ways: longer time constants, Limiting extreme Ddehavior, shaving peak loads, and 
displacing marginal supplies. (The last of these can be considered a micro or 
a macro effect or both, so this section inevitably overlaps somewhat with the 
following one. ) 

The concept of making failures happen more slowly in order to give more 


time in which to respond is familiar in preparedness planning. It is the 


rv 


strategy of a person who puts containers of water in the freezer as a “thermal 


flywheel" so that in a power failure, the freezer temperature will rise only 
slowly and cannot exceed the freezing pointe until all the ice has melted. It 
is the strategy of a smelting company that insulates its potlines to slow down 
their heat loss, so that if the electric current that keeps the alumina and 
ervolice molten is only briefly interrupted, thev will remain molten. (The 
alternative--months of work chipping them out with chisels--1s so unpleasant 


that 1f 1s worth buying a lot of insulation.) [ft is the strategev of stockpi.- 


ing, but improved: an energy svstem which uses 011 more slow!'v to provide the 





same energy services is Detter than one which uses more oil sut draws down a 


stockpile in case of supply interruption, because while tne stockpile costs 
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money to maintain and finance, the more efficient enerzy system saves money all 





the time, whether there is an interrupfion or noc. 


Let us consider a very localized, specific example of lengthening time 


constants: a superinsulated house [Besant et al. 1978; Dumont er al. 13) 





Saskatchewan Conservation House is in Regina at 60.5° N.latitude in a fierce 
climate--10,800 DDF/y, a design temperature (expected extreme cold) of -29 
and average insolation of 162 W/m? (about 10% less than the U.S. average). 
It is a two-story frame box with 2000 ft2 of floorspace, 2-40 walls (offset 
double two-by-fours), 8-60 roof, a tight 6-mil vapor darrier with infiltration 
less than 5% air change per hour, an 80%-efficient air-to-air heat exchanger 
averaging 0.6 air changes per hour (more can be provided if desired), double 
glazing downstairs, triple glazing upstairs, insulated night shutters, an air- 
lock entrance, and insulated door and foundation slab. As a result of these 
highly cost-effective measures, the total heat loss through the shell of the 


-@* 
= 
. 


house is only 38 watts per of temperature difference between inside and 
Outside when the window shutters are closed (55 with them open, 45 average). 
The gross shell loss totals only 41.2 million BTU/y. But after allowance for 
the "free heat" from windows, people, lights, and appliances, the net space 
Neating load is only 5 million BTU (1400 kW-h)/y--less than 4% as big as for an 
ordinary Regina house the same size*. Furthermore, the superinsulated house has 
a solar system big enough to cover all of its space and water heating needs, 


using no backup; yet that solar system contains only 190 ft2 of collectors 


(9.52 of 


rv 


he floor area) and 15.3 yd3 (3090 gal) of water storage (2.8% of 

the nouse volume). Most studies would predict that five to ten times this area 
and volume would be necessary to cover even two-thirds of the space- and water- 
heating load. How, then, can the smaller system be big enough? 

It is in answering this question that we see how profoundly the efficiency 
improvements have altered the basic physics of the house. An ordinary house 
requires sharp peaks of heat to maintain its inside temperature whenever the 
weather turns cold. These peaks often exceed 10 kW even in a mild California 
climate (Kahn 1979:316], and in an ordinary Regina house they would be many 
tens of kW, requiring either a large furnace or (with electric heating) 
installed generation, transmission, and distribution capacity costing about as 
much as the house itself. In contrast, the Saskatchewan Conservation House 
nolds in its heat so effectively that even with a 99 F° temperature difference 


across the shell--*70°F inside and -29°F outside--the interior temperature can 
be maintained with only 3.7 kW of totai heat supply if the shutters are closed 
or 5.5 kW if thev are open. Thus the superinsulation and the air-to-air eat 

exchanger have reduced the space-heating load from a series of huge peaks [0 a 


rt 12.5 MMBTU [Rosenfeld et ai. 1980] in 1978-79, 
the shutters and the net heat loss ° 
eturn to "about 5” with "some fu 





© 
due to air leakage around 
Cc 


*Besant et al. [1979) rep 
sun 
visitors/wk, but expect 
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ipS superimposed on a water-heating daseload. The average 
neat requirement is three times as diz for heating domestic water as for heat- 
img the whole house, even though the water-hneating load has itself deen reduced 
9y a third bv recovering heat from graywater. To cover the zgreatiy truncatec 
peaks of space-heating, far less collector area and storage volume is needed. 
" 


Secondly, although the house has “low thermal mass"--it can store neat 


only in its Light frame construction, so its heat capacity is onlv 


re 


Fo--its “cime constant” (the cime it would take for the inside to fal! 93.2% 0 
the way to the outside temperature if no heat were provided from any source) is 
about 100 hours, or about four times as long as for a normal house of similar 
construction. The Saskatchewan Conservation House stores no more heat, Dut 
loses it far more slowly. For delaving the drop in temperature, this is 
exactly equivalent. Such a house provides inherent protection, because if its 
heating svstem fails, a spell of cold weather is likely to have moderated de- 
fore the inside temperature drops far. For example, in O0°F weather, the house 
would take 34 hours to drop to 50°F in total darkness. Under the conditions 
least favorable for passive solar gain through the windows--averaging 787 WwW in 
December--the house would probably take several weeks to get as low as 50°F, 


and temperatures much delow that would be physically impossible unless the 





tightness of the house were somehow seriously damaged. Thus if the house had 
no working furnace, baseboard heaters, solar collector, or any other externa! 


neat source, an occupant willing to tolerate an English ratner than an affluent 


re) 


North American standard of comfort (sav 55-60°F in cold weather) could go right 
througn the Canadian winter without even realizing there was no heating svstem. 


This behavior illustrates both the stretched time-constant of the house-- 





everything nappens in slow motion--and its inherent limitation of extreme deha- 





vior. Any properly built passive solar house cannot get below about 50-55 F no 
matter what. Even a badly built passive solar greenhouse, provided it has a 
reasonable amount of thermal mass (rocks, masonry, drums of water, etc.) for 
Overnight heat storage, will never get below freezing, even in a Minnesota 
climate. So robust are structures of this kind that in one Massachusetts 
passive duilding, when vandals broke down the door and left a hole of 2-3 

rd* through the coldese night of the winter, the interior temperature still 
staved above 90°F. That building did not have insulating night shades, whicn 
would have stretched its time constant from davs to weeks.) If is also note=- 
worthy that the Saskatchewan house's heat-storage tank, spanning its full 90 F° 


temperature range, would suppliv space and water heating at the annual average 


rate, with no heat input, for +8 davs-- just iixe having a full JOOG-gaiton 21° 


tank in a normal house, or a tenth of the normal inventory of a Neating@-oi) 











Water stores only 0.5% as much energy as a gallon of oil, but serves about 
2qualiy well because so tucn less energy is required to do the same tasx. 
A third important result of the Saskatchewan Conservation House's superin- 
sulation 1s that neat can only diffuse inside the nouse--it cam scarcely get 
t. The inside of the nouse is in almost perfect convective and radiative 
equilibrium. Thus any point source of heat, such as one short section of unin- 
sulated hot-water pipe, can heat the whole house evenly without requiring 4 
Neat distribdufion svstem. In this wav an Alaskan superinsulated house can be 
evenly heated by a tiny stove putting out a few hundred watts in one corner, 
yet have uniform temperatures within about a degree even to its furthest cor- 
mer, far away around labyrinthine corridors. This means that if normal heating 
fails, a superinsulated house can be heated amply Sv any small, improvised heat 
source--a small wood- or trash-burner, a camping stove, a small lantern. The 
heat thus provided will provide comfort throughout the house, whereas in a 


normal house with a failed heating svstem one would have to huddle over a large 


tove to try to keep a single room habitably warn. 


we 


In short, the efficiency of this model house (quite aside from its use of 
solar energy) makes its occupants virtually invulnerable to heating failures. 
Their neighbors, who would be in serious trouble in a fraction of a winter day 
without heat, can take shelter in the efficient house and by doing so can pro=- 
vide enougn dSodv warmch to heat the whole house. If there are more than one or 
two neighbors, excess heat will have to be vented by opening the windows! If 
the tailure affected the heating sources of all houses, the occupants of the 
superinsulated house might find out only from the arrival of their chilled 
neighbors that anything was wrong; left to their own devices, they would prob- 


* 


adly not notice for weeks that their heating system was out of order, and the 


3 


the signal would be a drop from 68-72°C to perhaps 55-60°F, not a catastrophic 
drop to sub-freezing or subzero temperatures indoors. As in the Aachen house 
in Germany (four times less efficient, vet phvsically incapable in an average- 
weather vear of getting below 55°F inside with no space heating whatever), the 
occupants of such a house would be all but invulnerable to energy disruptions. 
Long time constants are not alwavs a Slessing. A Swedish superinsulated 
Nouse took about two vears Co attain its desian efficiency Decause its Suiiding 
materials had been left outdoors and wetted 5v rain. The ouse needed so 
Little heating tnat it took that long to dry out the materials. Likewise, a 
Large seasonal-storage tank for a community district heating svstem could 
easilv take a vear to “charge up” to normal working temperatures--thougn once 


neated, it would “coas indefinitely thereafter. Thus long-time-constant 











energy systems must be in place defsore an energy shortage strixes. 3ur if 
working then, thev are likely to ouclast the shortage and vast!v increase the 
flexibility of possible responses. 

The ability of either weil-insulated dDuildings with some passive gain or 
Sadly insulated buildings with strong passive gain to protect uncer ali circum 
stances against low (especially sub-freezing) temperatures means that activi- 
ties such as Zreennouse gardening can de guaranteed to work vear-round anvwhere 
south of the arctic Circle. Year-round passive-solar greennouse garcening, 
even using tropical species, has proven highly successful even in parts of the 
U.S. that have a three-month growing season outdoors. Another advantage is 
that even a very crude, unglazed solar water heater--such as a piece of black- 
ened sheet-metal attached to a hot-water pipe--can work well inside sucn a 
greenhouse. Being always protected from freezing by the thermal mass and solar 
Zain relationships of the greenhouse, the solar water heater needs none of the 
anti-frost precautions (draindown valves, double antifreeze loops with heat 

) 


exchangers, etc.) which can make conventional outdoor solar water heaters rela- 


tively complex and expensive. 





The foregoing examples have shown how a more thermally efficient house can 
reduce its occupants’ vulnerability by lengthening time constants, preventing 
extremes of temperature, and making small, improvised sources much simpler, 
more flexible, and more effective. But the house is only a microcosm for the 
entire American energy system. 

A 00-mpg car, for example, can de driven four times as many miles or davs 
as a standard car on the same amount of fuel. It can therefore canvas a con- 
siderably larger area in search of fuel, or be four times as lixelv to stav on 
the road long enough for improvised supplies of liquid fuel to be arranged*. 
Stockpiles of all kinds last four times as long, vet this fourfold expansion 


effectively incurs negative ext.a carrving charges because of the cash-flow of 





the cars’ fuel saving in normal operation. 
' 


An efficient car “frees up” three such cars’ worth of fuel; that is, given 


some constrained amount of available fuel, four times as manv car-miles can de 





onal 


’ - 


“Its engine may also be more suitadie than most for using unconvent 
ls, aS mentioned in Chapter 7: the Boat Division of Chalmers in sweden has 
even reportediy burned wood fleur successfullv in large diesels. Given ace- 


quate ludDrication, diesels tend to de less particular aDdDout ‘their fuel than 
ordinary Ottorcvcle engines. 
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9 [Energy Information Admiris- 
tration .961] would comsctitute a reserve capale of powerinz a 20-mpg fleer of 
130 million cars and light trucks for nearly 700 miles each, or four weeks 
driving at the average August 1979 rate. Thus the dynamics of anv fuel short- 
age would be dramatically different than with cars that must de refueled every 
few days. With such a fleet, mobility would be undiminished even if several 


major 2il pipelines, refineries, and ports suddenly disappeared. Fuel reserves 


in the pipeline’ Ddetween the wellhead and the gas pump would last not for a4 
few months but for a year or more--plenty of time to arrange improvised Diomass 
Liquid fuel supplies Large enough to run essential services if not virtually 
the whole fleece (Chapter 7). For the first time, stockpiles “in the pipeline” 
would last for aDout as long as if takes to repair major damage to pipelines, 
ports, etc., so the country could withstand considerable destruction of o11 
facilities without shortages or the need for interim rationing. 


Similar advantages would arise with electricity. Just as a house that is 
thermally efficient can provide most or all of its needs with “free heat,” so 
sme that is electrically efficient can rely only on the most uninterruptadle 
components of supply: Local renewables and grid nydroelectricity. Of course, a 
nousehold (in most U.S. climates) really concerned with saving electricity will 
nave not an electric refrigerator but a seasonal-storage icebdox--a superinsula- 
ted box which is filled with several ydJ of water each autumn from a garden 
nose, then allowed to freeze (via a removable panel of insulation) and spend 
che rest of the vear melting out through a drain-hole. Food on the other side 
2f a partation from the large block of ice will not spoil even in a permanent 
power failure. But even an efficient conventional refrigerator, using a few 


} 


hundred kwen/y instead of the present average of 14460, will itself warm up very 
slowly, Decause its efficiency derives partly from excellent thermal insulation. 
The week or more it will keep cool without power offers enough Dreathinag-space 
to hook up an improvised power supply or direct mechanical drive, using perhaps 
acar or bacycle. The installed generating capacity of generators and alterna- 
tors in U.S. cars and trucks is over 100 Gwe--a sixth as much as in the entire 
national grid--and, with present hydrovlectricity, would probably be enough to 
meet ali national electrical needs if electricity were used at 4a costreffective 
level of technical efficiency (Appendix A). If the stock of end-use cevices 
were economically efficient, essential household needs--food preservation, 
Lighting, radio [Goen et al. 1970:83)--would averaze only mout 50 WwW, rather 


than the present 300-500 Ww. This tiny power demand could 5e provided Sv 4 car 





> 
Dattery wita 2a small inverter, a tinv improvised wind machine, or a solar-celi 
array of a few squar2 yards. If the average car Dattervy nas a | WeA-n capacity 
212 VDC and is kept nalf-charged, the national ‘fleer’s Satteries store of order 


eT) 


ac current ef 


nousenoid needs at high efficiency for aout aalif a day*. In many communities, 
an industrial cogenerator or microhydro set that is currently a small fraction 


29f total supply could meer ail essential needs for efficient end-use devices 


even if that town's grid were comleteiv 
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improvised power sources [Foget & Van Horn 1969; Black 1971], sucn as motors 
driven Dacxwards Dv car and truck engines, would suffice to continue iife 
pretty mich as usual. As in a superinsulated house, the stretched time-con- 
stants and the greater scope for improvised supply would make energy efficien- 
cy the key to energy resilience. 

if this pattern of efficient end-use devices were widespread, baseload 
power from hydro, cogeneration, etc. could be wheeled for very iong distances 
without straining regional interties, and petroleumr-dependent peaking plants 
would not have to be fired up. Fuel stockpiles for any required thermal piants 
Or cogenerators would be greatly stretched; indeed, cogenerators with flexible 
dborler designs would often be able to run on locally availaDle wastes. Greater 


cogeneration in oil refineries and cnemical plants (most of which should de ne 
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exporters of electricity), Desides being economically profitable, increases tne 
plants’ self-reliance and ability to serve local users in grid failures. 
Additional peak-shaving measures Can produce similar benefits in doth 
routine and emergency operation. Peak-shaving cooperatives (Energy & Defense 
Project 1960:1560), expanded power brokerage among utilities (successfully used 
in Florida), and utility payments to communities for peak-shaving (as dy 
Pacicic Gas & Electric) are among the institutional mechanisms proven in the 
past few years. During the 1977-78 coal strike, DOE curtailment of uraniun 
enrichment shaved about 3 Gwe off the regional electric load; since enricned 
ufanium, aluminum, and other electricity-intensive products are easier to store 
than electricity itself, the existence of such processes in the load mx offers 
further load flexibility, with the carrying cnarge on idled plant operations 


often mich lower than the marginal cost of peaking power today. 





*lf¢ 12 VDC could be used: most, housenold devices currently use i1/ VAC, 

though smali inverters for recreational use are cheap and fairly common. Future 
nomes wired for Low-voltage DC, e.g. from photovoitaics, would use XC end-use 
Gevices, and if these were compatidie with standard car electrical voltages 
ftlexadility of emergency supply would Se greatly increasec. 
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Among the most important Senmefits of energy efficiency to the nation ane 
to the individual consumer is the displacement of marzinal supplies. That is, 
ertfticiency improvements can provide unchanged energy services not crir with 


2s$ im particular of the energy that comes ‘from 





the costliest or most vulnerable sources. Thus, decceaeis in tora. oil 
Simption would norsallyv de reflected as cgecreases in the use of o11 from the 
~@ast attractive source--OPEC and other imports. 

This thesis is easily illustrated bv arguing tnat U.S. oil imports can de 
eliminated Sv about 1990 by two relatively simple measures, either of which 
Nas deen seriously considered in Federal energy policy. The prescription is 
cistressingly simple: stop living in sieves and stop driving Petropigs. The 
Sieves \Suildings) are so leaky that just Dasic weatherization and insulation 
29f American dSuildings could save over 2.5 aillion dbl/d of oil and gas Sv 1990, 
at an average cost of about $6-7/b5b1, and a similar amount at a similar price 
during 1990-2000 [Ross & Williams 1979; SERI 1981]*. The Pecropigs (gas-guz- 
zling cars and light trucks), however, are a more complex probiem. 

Gas-guzzlers have such a low trade-in value that thev have Deen trickling 
Gown to low-income people who can afford neither to run nor to replace them. 
These cars are thus remaining in the stock longer when they should de turning 
over faster. (This is especially damaging because fleet efficiency is a geo- 
metric, not an arithmetic, average: a fleet which is $0% 60 mpg and 20% 10 apg 
has an average efficiency of 30 mpg, not 50 mpg.) Just as Suildings can de 
fixed up faster if efficiency loans from, say, utilities (Appendix A) relieve 
people of the up-front capital burden, so gas-guzzlers can de replaced faster 
if investment that would otherwise go to increase energy supplies were instead 
loaned or given out for car replacement. For example : 

- Rather than spending $20 billion (plus perhaps $68 Dillion iater) to 


even with o1i 


rr? 
a 
< 
a) 


subsidize synfuel plants which will probadly never Se compet: 
at anv particular price [Congressional Research Service 1981), the U.S. could 
save more oil faster bv using some of the same monev to pay at ieast half the 
cost of buving people a diesel Rabbit” or equivalent--provided they would scrap 
t*eir Brontomobile to get it off the road. (It cannot just de traded in, 


Se-cuse then someone else might drive it; it must be recycled and a death 





"Special mechanisms are available for accelerating retrofits 
ssed Sv Canadian utilities to retrofit metropolitan Toronto an 
25° to 6U0"H2 electricitve-fleets of specially equipped vans modifving ali the 
end-use devices in each neighborhood, one at a time--could also be used, ov the 
public or private sector, to tighten, insulate, and soiarize Suildinegs. 


~ Fs. 


the supporting calculations have been sublished elsewhere Lovins 1981)5/. 
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- Alternatively, tne U.3. could zee a 5S-vear or snorter averag? davdac« 
against synfuels 5v dvaving people at least $200 for every mpg dv whicn a Tew 
car improves on a scrapped one. People who scrap a Zas-guzzier anc So 202 
replace :t shoulé g-t &@ corresponding dSounty for it.) 

- Instead >* merely redirecting svnfvue. Sudsicies into setter cuvs, 25 
the two precec:irg examples, it would Be scill better to abolish the sudsicie 

~ ea > *r20a-> - ll -~ > * “h ’ md - - ™ Mus °- “cz *-* cr eec »?F "2 
2 oe - 2 .--* nar<e so.ut on. * e ~~ « Ca > cust al > ans ~~ - - . 
order of 350 billion on retooling during 1985-95 .von Hippel 1981:19i [< 
asdition the industry spent as implausidiv large a sum as 3100 S:1l..ion extra 
during the 1990s--probably enough to reDdDuilt Detroit--on retooling to convert 


one giant 


ry 


he average car made, in 


leapfrog, 





the Sest prototypes todav--and then spread that marginal retooling cost over 
mew U.S. fleet of cars and light trucks, then the average cost would average 
3770 per vehicle, and buvers would recover that cost from their gasoline 
savings, at $1.40/gal., in 14% months. 

The trouble with this last illustration is that Detroit goes not have 
money. But the o1l industry does, and is currently spending it on extremely 
expensive and risky drilling. [If instead Exxon drilled for cil in Detroit 
loaning the car-makers money for retooling to state-of-the-art efficiencie 


*vervore would be better off 


prodlems), and Exxon 


‘ 


Dil, producibSle (not extractable) a 
These examples 


Switching to a 90-mpg fleet 


imports from the Gulf, two and a half 
synfuel plants. Similar action with 
a haif million Sbi/¢é, or adout 

snort, just the two DdDiggest 

or so to a level well short of what 


, 7 


worthwhile, more than eliminate all 


se fore a power plant or synfuel 


whatsoever, and at about a tenth of 





"A more Mocest shift to «0 apg would 
i Million 551/d in Light truc«s 

*The United Auto Workers and several 
ce lerated scrappage for at least s3 


vet paid attention. The ome offic 
al Analvsis 1980) used such artif: 
were verv small and expensive. DCE 


1980) does not mention the possid 
nad not done even Sack-of-the-enve 
Even vray & von Hippe. L951 omit 
sv about 2000 anyhow. 
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Cnerefore save a cumulative 5830 bol of crude oil at a cose in the vicinity 09f 


3 invest the $100,000 dy buying 2940 barreis of OPEC oil at S2#/bD1, dur 
them into a fo.e in the ground, and call it a Strategic Pecroleum Reserve. While 


annual cost: of order 9l/bol for storage and (currently) $5-6/bd1l carrving 
charges. After 10 years, if the reserve has not been drawn upon, the 2940 
Qarrels of oil will scill be there. They represent an investment cost of $34/ 
o>L whicn is probably all recoverable, plus a ten-year storage and carrying 
cost of the order of $60-70/bb1, which is not*. 

4+. Spend the $100,000 on capacity to make synthetic fuels from coal or 
shale. Using a reasonable--and most Likely conservative--whole-system capital 
investment of $40,000 per daily Darrel, the capacity bought will have the 
potential, if it works, to produce 2.5 bbl/d (about 9000 bb1/10 y) from about 
1990 to 2620. By 1990, however, it will have produced nothing. The plant-gate 
price of its future output will probably be considerably in excess of $40/bbdl 
[Congressional Research Service 1981]; the retail price, perhaps $60-90/dd1. 


>. Spend the $190,000 on a small piece of the proposed Clinch River 


re 
rr 


Breeder Reactor. After ten vears it will probably have produced rothing. 
may thereafter deliver electricity at a price equivalent to Duying the heat 
content of oil at upwards of $370/bb1l (23¢/kW-h, about the same as from pre- 
sently commercial but expensive--$7/Wp--solar cells with a cheap optical con- 
centrator). The CRBR technology stands no chance of competing even with the 
costliest conventional alternative (Lignt-water reactors) until weil past the 
year 2050 [Lovins & Lovins 1980:70€£; Stockman 1977]. 

[t 18 perhaps superfluous to note that the official energy policy of the 
Inited States has lately deen to pursue these options almost exactly in reverse 
order, worst buys first*--worst buys in terms not only of money Dut of ability 
[OQ produce an immediate, continuing saving in oil imports. One is impelled to 


wonder whether we mignt not buy more resilience Dy stockpiling, noc oil, but 


| 


iberglas®, weatherstripping, and other materials for weatherizing buildings. 


J 
4 


NaCionai r.east-cost scenarios. 





How do these arguments appiv to all forms of energy throughout the 


mationail 2conomv? Two detailed 1969-81 analvses nave addressed this question. 





“ir worlc oul prices rose during storage, the o11 would appreciate; Dut the 
a y 


same is 2qually true of each oarrel § our previous two options. in 
- 


Chose cases, one can consider eitaer that imported o1l nas Deen avoided or 
that domestic oil nas been left in the zround as a “strategic reserve" with no 
purcnase or storag2 costs 
The svartuei 
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One, Dy Roger Sant and his colleagues at the Mellon Institute's Energy Produc- 
Civity Center, an industry-supported “think tank" ia Arlington, Virginia*, is an 
expansion of Sant's pioneering analysis [1979] of "The Leasc-Cost Energy Stra- 
tegy,” which "minimizes consumer cost througn competition.” That i979 analysis 
7 


sMowed tnat 12, for adout a decade oefore 1978, Americans had simply dought at 


each opportunity the cheapest means of providing the energy services which they 
actually received in 1978, then in tnat year they would have doughe abour 28% 
less o11, 34% less coal, and 43% less electricity than they did buy, and would 
nave paid about 17% less for their energy services than they did pay. Efficien- 
cy improvements would have made up virtually all the difference. 

in 1980-381, the same analysts then used an even mre detailed mdel, in 
which many hundreds of supply and efficiency options can compete freely, to 
examine the result of economically efficient investments during 1980-2000. They 
found [Sant et al. 1981] that even if real GNP zrew by 77%, primary energy use 
would rise by only 114, and all the growth would be in the industrial sector as 
others became efficient faster than their activity levels grew. Electricity 
demand would probably be stagnant for at least the first decade. Efficiency 
improvements (and some renewable sources) would so dominate the cost-effective 
choices that investment in conventional supply would virtually cease, and it 
would hardly be worth finishing building most of the power plants now under 
construction. The fraction of GNP used to Duy energy services would go down, 
not up, so that far from driving inflation, the energy sector would become a 


net exporter of capitai to the rest of the economy. Imported oil--the costliest 





Option except for new synfuel and power plants--would rapidly dwindle to about 
zero, simpl because it has already priced itself out of the market. If cannot 
compete wit. f€ficiency improvements (or with most renewables) and will there- 
fore essentially eliminate itself without special policy attention. 

These conclusions have been strongly confirmed by a parallel but indepen- 
dent analysis carried out by dozens of consultants coordinated Dy the Solar 
Energy Research Instituce [SERI 1981] at the request of then Deputy Secretary 
2 Energy John Sawnhill. The SERI draft report assumes an 804 increase in the 
1977 real GNP by 2000, and major increases in personal income, comfort, and 
mobility. It also tests efficiency and renewable investments against alterna- 
tive supply costs which, while not as low as Sant's, are still well short of 
realistic marginal costs. it embodies many technical conservatisms, and as- 
sumes no technology which is not already in operation in the United States. Yet 


é 


ic shows how primary energy use could decrease to 13-13% below tne 1950 level, 





and how, with economically wortnwnhile investment in oresently available renew- 


adli2 sources as well, the use of nonrenewable fuels would drop ov nearly nalt. 





“On 1 October 1981, thi astitution was succeeded Dy Appiied Energy Services, 
t ) c : 


$i 
mc. , whicn is Carrying on similar wo 
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At that level, noc only could oil imports and most frontier 91i and gas become 
unnecessary, but a zood deal of conventional lower-48 oil and gas could also de 
shut in as a dispersed "strategic reserve" with no extra storage costs. 

Total demand for electricity, too, would probabiy decline. With cost-ef- 
fective erficiency improvements and onsite solar heating systems, the el 
cal growth rate during 1978-2000 would de about 0.2%/y. With cost-effective 
wind, industrial cogeneration, and onsite photovoltaic investments added the 
"“zrowth™ rate would become zero to minus 1.4%/y. Under the former assumpt a 
(no wind, cogeneration, or photovoltaics), national electric supply would bde 
ample even if no new plants were commissioned after 1°85 and if all oil-fired, 
gas- fired, and old power plants had been retired by 2000. Under the latter 
assumption (all cost-effective renewable and cogeneration investments), supply 
would exceed demand dy about a chird--more than a sufficient margin to phase 
Out all nuclear plants as well if desired and still have capacity to spare. 

Thus the U.S. could enter the twenty-first century with a2 greatly expanded 
economy, zero use of oil, gas, and uranium in power plants, total consumption 
of fossil fuels reduced from about 70 q/y in 1980 to about 40-50 q/y in 2000, 
zero oil and gas imports, and ample domestic oil and gas in conventional, 
accessible sites to last for some further decades of transition to sustainable 
sources-~and could accomplish all this simply bv using energy in a way that 
Saves money. Nor is this a peculiarly American result. Similar studies, some 
in even greater detail, have shown comparable or larger savings for a wide 
range of other industrial countries, many of which are already more enerzy-ef- 
ficient than the U.S. These analyses, which we have reviewed elsewhere [Lovins 
et al. 1981], show that probably all countries can cost-effectively improve 
their energy efficiency by severalfold--a fact of considerable importance for 
the long-term balance of world oil supply and demand. It is especially encour- 
aging that this could be achieved simply by permitting market forces to achieve 
the optimal economic balance between investments in efficiency and in new sup- 
ply. A vulnerabilitv-minimizing, oil-saving strategy is also a least-cost 
strategy. It is not inimical to national strength, security, and prosperity, 
but is the very means of obtaining them. 

we have not considered here the many other advantages of such a policy: in 
reducing price volatility and price increases, in countering inflation and 


unemployment, in reducing environmental and social impacts, in moderatin 


® Ww 
rv 
© 
3 
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sions and inequities, and in alleviating the global risks of climatic ch 


(id.] and nuclear proliferation [Lovins & Lovins 1980]. All these effects are 


important. But thev, and energy vulnerability itself, need not de considered at 


all in order to conclude that greatly improved energy efficiency should de a 
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Wa 


dominant national priority on economic zrounds alone. ince this study is con- 
cerned with energy vulnerability and resilience, not with energy policy zgener- 


ally, we shall not consider here, as we have done elsewhere [id.:91-125! 


“ 


policy instruments by which such a result can best be achieved. Although our 


ww 
ve 
a. 


WwWN preference is for a combination of truthful prices (with sudsidies 
Other distortions removed) and of purging the market imperfections wnich inhib- 


it efficient 


a) 


2esponse to price signals, a more detailed consideration of how 
lieve the ends we have described is more in the realm of political 
philosophy than of our assigned suDject. Wwe therefore turn instead to the 
dther half of an inherently resilient energy system: the widespread use of 
renewadDle energy sources matched in scale and quality to their task, the so- 


@-r? 


soft technologies" [Lovins 1977b,197S]*. But while considering these 


called 
sources, we must not succumb fo the "zgadget-on-the-roof™ syndrome and lose 
sight of the cornerstone of any resilient energy system: highly efficient 
energy end-use. The benefits of that efficiency are as broad and indispensible 


as Laom~tse summarized them two and a half millenia ago in Tao Te Ching 59: 





In managing affairs there is no better advice than to be sparing. 
To De sparing is to forestall. 

To forestall is to be prepared and strengthened. 

To be prepared and strengthened is to be ever successful. 

To De ever successful is to have infinite capacity. 





*Sweden's energy R&D budget has reflected both priorities since 1978. The 
1981-84 proposal [Energy R&D Commission 1980] comprises 36% efficiency (over 
half of it in buildings), 40% renewables, 3% district heating, and 7% miscel- 
Laneous (system studies, basic research, and overheads). The balance,14%, is 
for nonrenewables--chiefly prior commitments in fusion and in fission safet 
and waste management, since over 3/4 of Swedes voted, and Parliament enact 
that Sweden will pnase out nuclear power by 2010. 
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7. INHERENTLY RESILIENT ENERGY SUPPLIES 





Our analysis of efficiency improvements in the preceding Chapter concluded 
that they are being implemented at an astonishing rate (Chapter 5.3) because 
they are the cheapest way to provide energy services. This trend should be 
encouraged in national policy, not only to save monev, buf because more effi- 
cient energy use greatly increases individual and national security. This 
Chapter will first build on that conclusion dy arguing that when used in con- 
junction with greatly increased energy efficiency, there is a particular form 
of energy supply--appropriate renewable energy sources--that offers similar 
security benefits. We shall then compare these sources in other respects with 
the technologies which dominate present Federal energy policy. To give at 
least a glimpse of the complexities and pitfalls of economic comparisons* sbe- 
tween renewable and non-renewable energy systems, we shall survey some generic 
features of those systems’ internal and external costs, and call attention to 
issues that arise when renewable sources are integrated into existing, mainly 
non-renewable, energy systems. With that foundation, we shall then briefly 
assess the technical and economic status of renewables, with special attention 
to some rapidly emerging technologies which hold special promise for increasing 
energy preparedness. 


7.1. The resilience of appropriate renewable sources. 





In Chapter 6 we compared two types of houses: a normal, thermally ineffi- 
cient house which rapidly reaches uncomfortable, even intolerable, temperatures 
unless continuously supplied with space-conditioning energy at large average 
and peak rates; and a superinsulated house which maintains tolerable tempera- 
tures with no outside energy whatever, and comfortable temperatures with vir- 
tually any small source--especially a simple renewable source. We showed that 
the latter type of house is cheaper, makes its occupants virtually invulnerable 
co interruptions in their supply of space-conditioning energy, and enables them 
to meet their space-conditioning (and other) household energy needs with much 


smaller, simpler, and cheaper renewable sources than thev could have done in 





*More fundamentally, any attempt at rigorous calculation and comparison of 


the costs, risks, and benefits of any energy technology is bound to run up 
against a host of serious theoretical and practical oostacles, which are 
beyond the scope of this studv but have been surveved elsewhere (Lovins 1977; 
Junger 1976; Council for Science & Society 1979]. 





the inefficient nouse. Thus we demonstrated a synergism between efficiency and 
renewables, and a correlation between favoradDl2 economics and resilience. 

The entire national energy svstem today is like the inefficient house-- 
Sependent for survival on continuous supplies of costly and vulnerable energy. 
it can and should be made like the superinsulated house--cheaper, ‘ess depen- 
dent, more resilience. If this is not done, no kind of energy supply can long 
Sustain the American economy, and the marginal supplies required even in the 
short term are so precarious as to pose a grave threat to national security. 

Federal energy policy has long assumed, as was widely believed a decade 
ago, that efficiency gains can only be small (perhaps 10-20%). If this were 
true, the U.S. would need far more energy in the future, and would have to get 
much of it by expanding the same kinds of inherently vulnerable energy systems 
which are of such security concern today. There would be no alternative to 
"Strength Through Exhaustion" (of domestic resources). A future of "The Past 
writ Large” would mean ever greater vulnerability, with no respite in sight. 

Analysts who hold this view do not readily appreciate the profound struc- 
tural changes which cost-effective levels of energy efficiency can bring. The 
SERI analysis (1981], for example, showed how the U.S. can achieve strong eco- 
Nomic growth over the next twenty years with--indeed, by--investing far more 
heavily in energy productivity, so as to achieve a proper balance with energy 
supply investments. If this were done, as we showed in Chapter 9, the most 
vulnerable sources (imported oil, LNG, frontier oil and gas, nuclear power) 
could be phased out entirely, and dependence on other vulnerable systems (cen- 
tral power stations and their grids, oil and gas pipelines, Western coal) could 
Oe greatiy reduced. But a result of even greater importance is that far more 
resilient renewable sources could cost-effectively supply up to 35% of total 
national energy needs in 2000--and approximately 100% within a few decades 


thereafter [Sorensen 1980; Lovins et al. 1981]. Sustainable sources, not 


er 


exhaustion, would then underpin long-term prosperity and security. 


Thus greater energy efficiency has the security advantage that it will 
rapidly eliminate the most costly and vulnerable energy systems. The remaining 


? 


demand will then Se so small (a quarter less in 2000 than today, and declining 
thereafter) that insecure and dwindling fuels can be most cheaply and easily 
replaced by almost invulnerable renewable sources--sources which, as we shail 


show Selow, are the cheapest long-run sources available after efficiency gains. 


rt) 


ar from being minor, unimportant sources, the manv kinds of appropriate renew- 
able technologies would make a major and soon a dominant energy contridution. 
Thus a major struc ural change in energy supply would become Doth possible and 


‘ 


economically preferable--completing the transformation of the American energy 








29S 
System from living on energy capital to living on energy income, and from 


vulnerabilitv to resilience. 


' . : 7 - : - 
By “appropriate” renewable sources--"soft technologies” for short--we mean 


those which supply energy at the scale and in the quality which will provide 





each desired energy service at least cost to the consumer. Chapter 5 showed how 
a mismatch of scale between source and use can roughly double energy service 
costs Dy incurring the costs and losses of a vast distribution network. Proper 
scale for each task can minimize those costs and losses. Likewise, Appendix A 
describes how supplying energy of the right form for each task can minimize the 
costs and losses of energy conversion. Thus the 92% of U.S. delivered energy 
which is needed in the form of heat, or as a portable fuel for vehicles, is 
most economically supplied in those forms--not as electricity, which is cost- 
effective only for a premium 3% of all delivered energy needs. This is decause 
electricity is conventionally generated in costly, complex machines which lose 
two-thirds of the energy in the fuel in order to make a high-quality energy 
form. Lf that quality is not used to advantage--if, for example, the electri- 
city is used for space-conditioning--then the whole conversion process was a 
waste of money and fuel. Most “appropriate” sources are thus non-electrical. 

Renewable sources are often described as “new,” “unconventional,” or 
"exotic." None of these labels is accurate. To be sure, manv renewable energy 
technologies have been greatly improved by modern materiais and design science. 
But this is only the latest stage in an evolutionary process stretching back 
for hundreds, even thousands, of years [Butti & Perlin 1980]. Such technolo- 
zies as passive solar design, windpower, and biomass alcohols were well-known 
in rather sophisticated forms millenia ago. Solar concentrators were used in 
the Battle of Syracuse ‘the only significant known military use of solar tech- 
nology). Flat-plate collectors are two centuries old; photovoltaics and solar 
Neac engines, over a century. Repeatedly, many solar technologies have decome 
respectably mature only to be cut off by the discovery of apparently cheap 
deposits of fuels, whether wood in the Roman Empire, coal in industrializing 
Britain, or oil in our own time. Each time, as scarcity and a sense of inse- 
curity returned, the renewable sources have been reinvented. The latest re- 
emergence may be the last time it is necessary to repeat this orocess. 

The most obvious feature of renewable energy sources is that thev harness, 


St nuclear fuel that is verv unevenly distribduted in 


er 
© 
, 
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not a deposi 


the earth's crust, but a variety of direct and indirect fluxes of solar energy* 





*We do not consider Aere geothermal energy or tidal power (moonpower), since 
neither is renewable in principle. In the right sites and with due attention 
to their considerable potential for environmental damage, however, 30th can de 
localiy importante for providing heat and electricity respectively. 
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2quitablyv, and daily over the entire surface ofr 


the earth, and are noc subject to embargoes, strikes, or other major interfer- 
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ly" does not mean equally. The flux of solar energy ‘fluctu 
d space, doth according to the predictable partern of the earth's 
rotation and orbit and according to the variations of weather, which tend to be 
more stochastic (random in detail but statistically predictable in general 
pattern). These variations, however, are quite well understood |Sérensen 
1979!, and a properly designed renewable energy system can readily cope with 
them--given efficient energy use--by using the combination of sources and de- 
$izgn parameters suitable to each site and application. Sources can de chosen 
which tend to work best in different weather patterns, i.e. which have nega- 
tively correlated output: cloudy weather, bad for solar cells, is often good 
for windpower, aud droughts, bad for hydro, are good for solar cells. Existing 
storage, like water behind hydro dams, or on-site storage can be provided. End- 
use devices can be designed with long time constants to cope with intermit- 
tence. Solar energy can be harvested and converted from vegetation at one's 
convenience rather than captured instantaneously as direct solar radiation. 
Sources can be integrated over a sufficient area to average out fluctuations in 
the renewable energy flux or in end-use patterns. 

The intermittence of renewable energy fluxes is smaller than one might 
imagine. A tvpical wind machine in Denmark needs only ten hours’ storage to be 
as reliable as a typical light-water reactor [id.:582f]. The statistical com- 
plementarity of wind, hvdro, and solar cells (photovoltaics), especially if 


dispersed over a sizeable area [Kahn 1979:319f], can make a grid combining them 


more reliable chan one using fossil=- or nuclear-fueled steam plants. Such 


results often surprise designers of today's “hard technologies.” But they need 
to appreciate better the unreliability of their own svstems. In principle the 
need to design for fluctuation is nothing new. Today's energy systems fluctu- 
ate too - less predictably, whenever there is an o11 embargo, coal strike, 
etc., amc this kind of fluctuation must also be guarded against by design. 
Failure to do this adequatel»--to consider the impact of surprises, failures, 
and deliberate disruptions--has indeed helped to make today's energy system as 


’ 


vulmeradle as it is. Fluctuations in renewable energy fluxes are in this sense 


setter understood and more predictable than those in the suppiy of conventional 


fuels and power*, The calculations that go into writing a weather forecast 





*They also tend to be iess severe. Kahn (1978:33)], for example, 
im a Pacific Coast wind arrav, "a lull...which reduced power to about 1/3 the 
summer mean would last for 15 hours with 95% probability. For 99% 

adilitv of (at least)...1/6 the summer mean, the lull would ‘ast about 10 

hours. For comparison, however, major outages of LWR generators Nave an aver- 

age duration of 300 hours [at zero output! .” 
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2r an ephemeris of the motions of the sun are considerably more reliable than 
those that predict reactor accidents or Saudi politics. One can have greater 
confidence that the sun will rise tomorrow than that someone will noc blow up a 
supertanker in the Straits of Hormuz. It can be cloudy for davs or weeks (nor, 
as noted below, a serious impediment to solar systems designed for cloud), dut 
tne sun cannot be totallw eclipsed for months like an oil-import cutoff. 


we have deen careful to state that appropriate renewable sources-nor all 





r 
renewable sources--offer economic and security advantages. Unfortunately, the 
overwhelming emphasis in Federal renewable programs 30 =ar has been on the 
least economic and least resilient renewables, especially the central-electric 
ones. The historic reasons for this tendency to “make solar after the nuclear 
model," as two veteran observers remarked [Hammond & Metz 1977], are rooted not 
im economic rationality but in mere force of habit. The RSD managers assumed 
the desired product was baseload electricity, even though the 8% of delivered 
energy needs that can give us our money's worth from electricity--a special and 
very expensive form of energv--are already met twice over by power stations 
already in operation. Federal energy gencies and their major contractors also 
assumed, all but universally, that the wav to develop renewable sources was to 
build prototvpes--first of megawatt scale, then working up in stages to giga- 
watt scale--just as if the product were a new kind of fission reactor. They 
apparently assumed that anything else, or anything designed for a market other 
than utilities, “would fall short of a major contribdution”™ lid.]. Believing 
solar contributions would be small and far in the future, they sought to carry 
out their self-fulfilling prophecy by emphasizing the least economic designs. 
Thus considerable engineering talent, and contracts probably amounting to 
tens of millions of dollars, have been devoted to conceptua! designs for solar 
power satellites, even though the cheap, efficient solar cells which thev pre- 
suppose would deliver far cheaper electricity (rocoman 1981] 4f£ put on roofs in 
Seattle. In that form they would be virtually invulnerable, whereas in orbit 
they could (as Hermann Oberth pointed out a half-century ago) be turned into 
Swiss cheese bv anyone who cared to buy a weather rocket and launch a load of 
Sirdshot into the same orbit in the opposite direction, there to meet the vast 
collector areas of the satellite every half-nour at 36,000 miles per hour. 
Likewise, DOE has spent most of its wind budget on developing multi-MWe 
machines with D'ades like a 747 wing. They are enormous, complex, drome to 
Nigh-technolog ilures, and useful onlv to large utilities. Each unit costs 
millions of dol irs and is made, rather like a jetliner, Dv a highly special- 
ized aerospace firm, then shipped across the country to the site. In contrast, 


some U.S. manufacturers have independently develoved wind machines in the kwe 


or tens-of-kWe range which have simple bolt-on sheet-metal DSiades, no Srushes, 
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one Dearing, two or three moving parts, and essentially no maintenance require- 


ments (p. 176). Any handv person can make and use them. They are available now 
246) at lower costs per kwe than DOE estimates its gesigns will drop down co. 

An anecdote reveals the philosophical divergence. After spending tens of 
thousands of dollais on computerized electronic sensors to shut down a DOE wine 
machine if it started to vibrate too much, its designers visited the 200-kwe 
Gedser machine operated decades ago in Denmark. [Its vibration sensor was a 
Saucer comtaining a large steel ball. If the tower shock too much, the Ddall 
would slop out of the saucer and fall down, and a string attached to it would 
pull a switch. (There is a postscript: the DOE sensors proved unreliable, and 
had to be supplemented bv a closed-circuit TV camera monitoring a painted film 
can hung from a string so the operators could see when the tower shook.) 

There is thus a considerable difference between the renewable sources on 
which most Federal attention has been focused and those sources which merit it 
by their economic and security benefits. This difference is partly in unit 
scale and simplicity. It is partly in the types of technologies considered: 
we have not, for example, found an instance where central-receiver solar-ther- 
mal-electric svstems, or ocean-thermal-electric conversion (OTEC), or solar 
power satellites, or monocultural biomass energy plantations, look economic or 
necessary. And the difference is also partly institutional and psychological. 
DOE has tended to favor “inaccessible” technologies which reinforce the suppo- 
$ition that ordinary people should be mere passive clients of remote technocra- 
cies. This in turn encourages people to think that if energy supplies are dis- 
rupted, “the Governmenc™ will take care of it. We believe it is important, if 
energy preparedness is to become a reality, that people feel empowered to use 
their own skills, solve their own problems, and largely look after themselves. 
This requires in turn that they have, and know that they have, most of the 
technological means to do so. 

We premise this Chapter, then, on the assumption of intelligent design 
based on sound economic principles, not on mere habit. Given such good design, 
renewable energy systems can systematically fulfil cheir outward promise of be- 
ing difficult to disrupt. Consider, for example, how soft technologies can avoid 
most or all of the twelve sources of vulnerability identified in Chapter 2.1. 


They are unlikely to bring the user into contact with dangerous materials (ex- 





plosive or radioactive); even renewable liquid fuels (alcohols and pvrolvsates) 
tend to be much less hazardous, in flammability and toxicity, than their petro- 
leum-based counterparts. ‘(A possible exception is that certain types of soiar 
cells can be made with small amounts of cadmium, arsenic, or other highly toxic 


Materials, and the Surning of a cell-bearing house could release these to the 
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2nvironment in quantities of tens or hundreds of grams. Highly efficient cells 
can also be made, however, at similar or lower cost from other materials which 


are either nontoxic or refractory.) Far from naving limited sublic acceptance, 





appropriate renewable sources enjov a 90*%. complete consensus unmatched 5v anv 
other category of energy technologies {Farhar et al. 1980; Milstein 1978]. With 
the exception of existing large hydroelectric dams appropriate for the few -con- 
centrated end-uses of electricity, such as smelters, sensibly designec renewa- 


dle sources avoid centralization of supplies. Because they collect renewable 





energy flows where they are, rather than mining a fuel elsewhere and transpor<t- 


ing it, they do not suffer from long haul distances. Their usual range is from 





inches or feet (in buildings) to miles or perhaps tens of miles in some DSiocon- 


version systems. Limited substitutability is seldom characteristic of renewable 





sources: many Dioconversion systems, for example, can cope with an immense 
range of feedstocks within broad limits of wetness and cardon/nitrogen ratio, 
and some, like the thermochemical processes (p.244), can make the same widely 
usable liquid or gaseous fuels from any cellulosic or woody feedstock regard- 
less of origin. Likewise, efficient solar collectors can be made out of a vast 
range of materials--glass or plastic or recycled storm-doors for glazing, steel 
or aluminum or wood or paper or plastic film (or even beer cans) for absorbers, 
rocks or masonry or water-filled oil drums or recvcled bottles for heat stor- 
age, or even a hole in the ground and some brine--a solar pond--in lieu of all 
these components (p.241). The range is limited mainly by one’s imagination. 
Unlike large turbogenerators, renewable sources of electricity are diffi- 
cult to damage if synchronization breaks down. A solid-state grid-interface 
device can enable them to cope with unusual or rapidly changing electrical con- 
ditions which normal electromechanical devices could not handle (p.224). Renew- 


able sources integrated into a grid require synchronization, but with proper 





design they can also, unlike other sources, work as well into a local load 
without synchronization, in isolation from the grid, or even on direct current. 
The tendency of properly designed renewable sources to distribute energy in the 
final forms in which it will be used, such as heat or unspecialized vehicular 


fuels, eliminates manv of the inflexible delivery svstems that make their 





nonrenewable counterparts so logistically complex. The cheapest and most 


effective renewable designs also tend to avoid interactions dDetween enerzy 





Systems--whether bv substituting convective circulation for active pumping in a 
—_ = 
thermal system or dv using wind stirring or solar process heat in Sioconver- 


sion. Although manv soft technologies have modestly high capital intensity, 





theirs is considerably lower (as we shall show below) than their competitors’, 


and they have an even greater advantage in avoiding long lead times and 
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specialized labor and control requirements. Their distribution svstems, toc, 





are seldom large enough to make distribution of noxicus ta 


? 
v 
" 


tials a significant 





concern. while all these agreeable properties are not a necessary part of 4 
renewable energy svstem, they will generally result from design for least -ost. 
Properly arranged soft technologies also satisfy most or ali of the prina- 


ciples of resilient design (Chapter 4.4). They are mainly dispersed to matc! 





heir uses (Chapter 5.1). Their large numbers, diversity, and overlapping end- 


5 
use functions can offer both numerical and functional redundancv--as in a town 





whose blend of a large number of different sources of electricity (wind, sicro- 
hvdro, solar cells, solar ponds with heat engines, etc.) or of biomass liquid 
fuels offers built-in backup in case voarticular devices or types of devices 
have trouble. Electricityv-generating soft technologies can readily be inter- 


comnected while maintaining node autonomv--the ability to stand alone at need 








(Chapter 7.2.3). They provide far greater functional flexibility in adapting 





to changes in operating conditions and feedstocks than virtually anv “hard 
technology” could tolerate. Their design can readily incorporate--and often 


Will for economic reasons--modularityw and standardization, as in mass produc- 








tion of solar celis or site-assembly of mass-produced collector components, al- 
though the diversity of people and institutions pursuing them will help to pre- 
vent a degree of standardization that might serve to propagate design errors. 


That safeguard is reinforced by a speed of evolution that has compressed gener- 





ations of technical development into a few vears. Being made of relatively 
cheap and simple materials and using relatively undemanding processes, soft 


technologies can readily incorporate internal decoupling and buffering without 





unreasonable extra cost. Their simplicity and forgivingness, their accessibii- 











itv to and reproducibility bv a wide range of actors, and their social compati- 








Dilitv are among their main hallmarks. There is hardly 2 quality conducive to 
resilience which thev do not have in abundance; aardlv ome conducive to 
drittleness and vulnerability which, with proper design, they cannot avoid. 

These resilient characteristics, however, are not a sufficient basis for 
choice. Indeed, our discussion of efficiency improvements in Chapter 5 ignored 
their security benefits and considered only their economics. To be equally 
conservative, we should take a similar course here. We therefore consider ext 
some generic problems of comparing energy technologies, as a prelude to 
Surveving the state of the art in appropriate renewable sources. 


> 4 “ 


7.2. Assessing soft technologies: zeneric issues. 





Calculating the economics of renewable compared to nonrenewable energy 


sources (or renewables vs. each other or vs. efficiency improvements) is easy 
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value of renewables sepends Sorh on the price of the energy thev deliver anc on 
tne price of the energy thew replace. Both are nighly uncertain. 
evaluated onlv with reference to a particular energy service delivered to 4 
final user. Market price reflects some “internal” costs Sut excludes others 
‘externalicies™), such as unregulated forms of pollurion, vulnerability, or 
other costs paid by neighbors or Sv society as a whoie, mot specificaliv Sw the 


ore consider internal and external costs separatelv. 
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cei. Internal costs. 


Renewable energy systems have 10 fuel cost (except for the feedstock to 
Sioconversion svstems and, perhaps, water rights for some hydro). If well 
designed and Suilct, they also tend to have low operating and maintenance costs. 
(If not, lomg-term economic performance can be quite sensitive to those costs.) 
The price of renewable energy therefore depends mainiv on: 

1. Thetr initial capital cost. This depends strongly on 

a. The simplicity, cleverness, and durability of design. These can 
vary enormously and may bear no relation to the designer's formal 
credentials: indeed, highly qualified designers mav produce the 
Most gratuitously complex designs. 

>. The marketing structure. A “packaged” flat-plate solar collector 
svstem with three or four markups can cost several times as much 


as an otherwise identical “site-assembled™” svstem with one markup 


. Worcester Polv. 1978; Godolphin 1981}. 
- ow efficientlv the delivered enerav is used. This affects, as we 


rw 


noted in the Saskatchewan Conservation House example, the size o 
the renewable system (which can de altered bv tenfold), its per- 
formance, and its complexitv (as in the replacement of a heat-dis- 
tribution system dy natural convection). Such synergisms can be 
examined only on a micro design level. 

These effects can together change unit prices Sv factors ranging from 


ten £0 pertaps a thousand. 


2. The cost of financing them over their lifetimes This sepencs on 
a. Real interest rates, which depend on perceived risk and should 
therefore de lower for many renewadles Kann et a). 1980 
——— 


9. Working capital requirements. These are related 55 capital inter- 
Sitv by comstruction time, pavdack time, and shape of casn-flow, 


and again should be more favorab.ie for soft techno.iogies .:¢. 





may 
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d@.. tor cecaces witn .ittie or no maintenance Sadiy Su:.t, tne 
could have farled in a few sonths or vears. Some sesigns are muce 
more fOrgiving of Bistakes anc envirommenta: insu.ts than others 


che amount of energy supplied annuallv. This sepends om 

a. Quality of design, construction, operation, and saintenance. 

>. Patterns of energy use. «a Bismatch Setween suppiv and demand 
patterns could leave some cGemand unmet or iead to the “dumping” of 
surplus supply (such as unneeded space heat in the summer). 


c. Variations in weather and climate. 


tm 


. Appropriateness of design to local conditions and use patterns. 
Some large corporations have deen unable to compete in the solar- 
collector market with some small Susinesses, not only Secause th 
latter had better innovation and lower overheads, dDut also because 
thev ‘could achieve Setter performance dv matching designs to local 
weather, building stvles, etc.--rather than making a “cookie- 
product which is designed for a hypothetical average case 
and is therefore suboptimized for any actual particular case. 
The amount and type of storage required, if anv. This depends on the 
three factors just listed and om the nature and degree of integration 
with other renewable or nonrenewasle sources. (We shall consider 


these integration issues further below.) 


seem, and if is, more complex than one might have expected. Sut to 


matters worse, the price of competing nonrenewadie energy is equally 
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iderable. It desends mainly on 


weneral and sector-specific inflation in the cost o 
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and monev, doth during construction and afterwards for the project's 
Operating lifetime. 
The relationship between historic and marginal capital costs. The 


latter have zenerally exceeded the former since about 1970.) 
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National and local solicies regarding trade, legal structures, infia- 
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Technical reliability and resilience desired. 
Tax and accounting conventions, tariff structures, and subsidies. 
Sudsidies to the U.S. energy system total! over $252 billion (1978 $) 
historically [Cone et al. 1980], with the nuclear term sufficing to 
cut the apperent cost about in half [Bowring 1980; Omang 1981]. Tax 
and price subsidies are currently continuing at a rate of the order of 
$100 billion per year [Lovins 198la]--enough to reduce average energy 
price by over a third and nuclear electricity price by over half again 
[Chapman 1979]. 
Salvage values. (For nuclear facilities and wastes these are negative 


but of unknown size.) 


Renewable/nonrenewable comparisons are further complicated by the 


ollowing problems: 


l. 


tt 


Great variation in price quotations even for one product in one mar- 
ket. Identical gas-fired water heaters in identical Southern 
California apartments differ by a factor of two in retail price and by 
nearly a factor of three in installed price. Price scatter is iarger 
in solar markets, which are less mature and have more diverse product 
lines and marketing structures. 

Extremely rapid technical change, especially for renewables, much of 
it outside official programs and traditional informacion channels. 
Uncertainty about how far, or how, to internalize important externali- 
ties (many of which are considered further below). 

what depletion value to put on nonrenewable fuels and other resources. 
Their cost was traditionally assumed to be only the cost of mining 
them, as if that mining did not make their future replacement more 
costly to society. 

Asymmetries in tax and price subsidies, generally favoring nonrenew- 
ables. Reliable subsidy assessments are very scarce. 

The many imponderable (e.g. psychological and political) factors that 
help to determine how far and how fast different available technolo- 
gies can be put into use. 

Economies and diseconomies of scale (Chapter 5). 

The inability of most simulation models used by energy policy analysts 
to cope properly with diverse, relatively dispersed renewable sources 


or with their nontraditional processes of market penetration (Chapter 


The need to match anv renewable source to its climate, site, applica- 


tions, and users, in order to achieve best performance at least cost. 
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fifficulty of comparing the storage and backup requirements of 

complete energy systems containing renewable or nonrenewable compon- 

ents, to achieve a given level of reliability to final users, when 
there is not a fully satisfactory reliability theory for either tvpe 

f[ system, let alone for doth in combination. 

Ll. The potential for total-energy systems which provide electricity and 
heat (and perhaps liquid fuels) and for other types of hybrids (dis- 
cussed below). 

12. The opportunities offered bv many renewable sources (Dut only rarely 
Dy nonrenewables) for sharing functions and costs through integration 
into shelter, food, water, or other systems. 

13. The difficulty of identifying such integration opportunities, or 
indeed many renewable energy opportunities Sv themselves, without a 
highly localized and disaggregated analysis. 

14. The sensitivity of economic comparisons to minor changes in accounting 
for inflation, “levelizing” varying costs over the life of a project, 
discounting the future, etc. Small, seemingly innocuous changes in 
real discount rate are a commonly used method of reversing the merits 
of renewable/nonrenewable comparisons. 

In view of these complications, it is not surprising that virtually no 
renewable/nonrenewable cost comparison will prove satisfactory to everyone. 
Experts often disagree about basic data by factors of severalfold, depending on 
their familiarity with recent developments and willingness to accept empirical 
data as “existence proofs." They differ in their assessment of the state of 
the art or the applicability of certain methodologies. They do not accept 
other experts’ views on how far particular case-studies are more widely applic- 
able. Thus a large number of energy experts, laid end to end, will probably 
never reach a conclusion about the economics of renewable sources. 

The only recourse is to make assumptions and data sources explicit enough 
so that cost calculations are transparent, scrutable, and easily compared. It 
must also not be expected that the unit cost of any technology can be repre- 
sented dv a single number. Economic theory indeed requires that each techno- 
logy (or aggregate of different technologies) be subject to a "supply curve” in 
which umit price rises with increasing supply. That this is the case for con- 


ventional utility power-plants, owing to a complex series of political-regula- 
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tory relationships reflecting a public desire to hold constant the perc 
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social cost of expanding coal and auclear sectors, is nicely illustrated in the 
} 
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following graph. It plots as supply curves the data obtained by Komanoff's 


Sed 


.1981] statiscical analysis of historic costs, which explains 92% of the ob- 
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served variation in the real cost per installed kwe of nuclear plants and 638% 


for coal-fired plants, with samples of 40 and 116 plants respectively. 


Plant construction cost (1979 steam-plant S$ per net kWe installed, without 
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Although the shape of the supply curve would probably differ--especially 
in being concave rather than convex upwards--renewable sources too have supply- 
Curve costs rather than point costs. For example, solar heat collectors small 
enough to go on a building usually cost less than those which require extra 
land (usualiy an artifact of inefficient energy use). Biomass fuel systems 
which convert special crops--likewise a symptom of inefficient use--incur extra 
farming and collection costs compared with those that use wastes already 
harvested, especially where those wastes are currently a nuisance and any new way 
2f disposing of them earns an economic credit. Most official analvses of 
renewadle sources evaluate their costs on the high, steeply sloping portions of 
their supply curves to which inefficient energy use drives them. The low, 
shallowly sloping portions, however, reflect a more nearly optimai economic 
Dalance between investments in energy supply and in energy productivity, and 
therefore represent the supply corresponding to the “market clearing price” at 
which the supply and demand curves cross in equilidDrium. Hence energy supply 


costs cannot be analyzed independently of competition with energy productivity. 


\ 
eee SF ee Beeee SE SHH ewe es we 





BEST DOCUMENT AVAILABLE 





215 
Despite all the zZeneric uncertainties of renewable/nonrenewable cost 
comparisons, four broad principles can often simplify economic choices: 
l. Investment decisions should be based not on projected small differen- 


es of marginal cost (which are often well within the uncertainty of 


(a 


the data) but rather on how sensitive those costs will be to changes 
in key variables such as oil price. Basing decisions on sensitivities 
enables ome to "play safe" in an uncertain world. In general, the 
variations of most policy interest, such as nigh world oil prices or 
high inflation, tend to improve the competitive position of renewables 
still further. Yet soft technologies do not (as Chapter 7.3.1 snows) 
require such assumptions for their attractiveness, since they can 
generally compete with present oil prices with considerable room to 
spare. 

2. Differences of internal cost may be less important to many nations 
than differences not captured in that cost--implications for resili- 
ence and self-reliance, employment, equity, balance of trade, etc. 

3. In general, the real costs of fossil and nuclear energy are likely to 
rise and those of most renewable sources to fall. The relative speeds 
of change in both cases are the subject of great uncertainty and dis- 
pute, although the directions of change are empirically undeniable and 
the rundamental reasons for those changes are all but certa.n to 
persist. 
+. In general, renewable sources offer far greater scope than nonrenew- 

abies for simple, low-technology adaptations suitable for local con- 
struction with limited skills and common materials. Such simplified 
versions cost far less than those normally analyzed; they are more 
analogous to the improvisations commonly made by individuals at a 
Zrassroots level. [t is difficult to capture the enormous range of 
costs reported for such self-help projects, especially those done dv 
low-income people who do not cost their own labor or who do coopera- 
tive projects. But in general the real costs to the users are far 
less--even orders of magnitude less--than for conventional, industri- 
ally supplied hardware, and the performance is often Ddroadly compar- 
able and sometimes better. 

This last point deserves special emphasis. It is difficult to model, but 

familiar to anyone who visits community-based energy projects or who reads the 


manv journals (New Shelter, Popular Science, Popular Mechanics, etc.) devoted 





to self-help and "vernacular technology.” What a high technologist would de 


Likely to do with a steel tower, an aluminum extrusion, a Fiberglas® sheet, or 
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a plece of digital recording electronics can also de done passably well with 
scrap lumber or lashed saplings, a piece of an old oi! drum, a sheet of cloth, 
Or a person with pencil and paper. High technology is not inconsistent with 
cheapness or simplicity: a recently developed digital recording anemometer for 
analyzing proposed windpower sites is made of a $4.95 calculator, cups from two 


Dantvhose containers, and similar odds and ends, then calibrated dy driving at 


xnown speed down a highway on a calm day while someone holds the gadget out the 


’ _) 


c2 
window. It costs in all around $10, duc performs about as well as commercia 
versions costing many hundreds or thousands of dollars. There are tens of 
millions of Americans who would have no trouble making one. Similarly, the 
project managers for some fancy Federal solar projects were amused, on visiting 
One experimenter, to find that in testing solar panels he measured their water 
flow, noc with their fancy digital flowmeters, but with a bucket and stopwatch. 
They were less amused to discover that the National Bureau of Standards cali- 
Drates their flowmeters with a bucket and stopwatch. 

We do not mean to dwell unduly on “haywire rigs"--the kinds of technology 
that can be put together from things that are lying around in virtually any 
farmyard or town dump in the world. But neither can their potential be ignored 
in favor of the highly refined designs more familiar to well-funded high tech- 
Nologists. Whatever they may chink of these odd-looking improvisations, they 
must at least admit that oil refineries, reactors, solar power satellites, or 
multi-megawatt wind machines do not offer the same potential for simplified 
versions at greatly reduced cost. That potential is advantageous enough in 
normal times; in emergencies it becomes absolutely vital. 

Subject to these caveats and uncertainties--the last, the immense range of 
technical complexity and costs over which many renewable options can be built, 
being perhaps the most difficult to analyze--illuminating comparisons of re- 
newabdle/nonrenewable economics are in fact possible, and can compensate for 
fuzzv data with multiple conservatisms. With good design and careful shopping 
for best buys, and basing responsible analysis on empirical data (below), many 
renewadle energy systems already arguably offer a pronounced economic advantage 
(@speciailv at their incremental cost). This advantage is generally increased 
9v doing the still cheaper efficiency improvements first. This economic rankx- 
ing of Marginal sources--efficiency improvements cheapest, then appropriate 
(synfuels and power plants)  |Stobaugh & Yergin 
1979;--does not take account of external costs and Senefits not currently 


1 = ‘ P } * - = 
lustrative numbers support 


reflected in market prices. Before offering some il 
ing our generic conclusions, we must therefore detour dSrief 


externalities are and whv they are argua ‘y at least as important as interna. 








Economicaliv efficient allocation of social resources requires that energy 
eft to compete freely with each cther and to stand or fall on 
ir economic merits. But market prices do noc reflect, and are not meant to 
reflect, many important social costs and benefits. Even if they did, an eco- 

nomically efficient result might not be equitable, and cannot be expected al- 

Ways CO coincide with the results of the political process, which ts designed 

to reflect and protect a broad range of interests not represented in market 


processes. A democracy works by "one person, one vote,” but the marketplace 
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works by "one dollar, one vote,' 


and the dollars are not evenly distributed 
among the people. To increase equity, political compatibility, and correct 
long-term distributions of resources (which is not something markets do partic- 
ularly well), it is therefore important at least to recognize some of the main 
external costs and benefits of alternative energy technologies. 

In economic formalism, it is rot correct to count emplovment as a benefit 
of any project: it is treated (and must be for theoretical consistency) not as 
a Denefit but as one of the costs of production, in the form of wages, salar- 
ies, and benefits whose payment causes some other useful output to be foregone. 
The amount, duration, location, and quality of work provided by energy projects 
are nonetheless socially and politically important. Such projects can either 
increase or decrease total employment. Power stations, for example, are so 
capital-intensive that each Gwe built destrovs about 4000 net jobs by starving 
other sectors for capital [Hannon 1976]. In contrast, careful and detailed 
case-studies [Buchsbaum et al. 1979; Schachter 1979], confirmed by more aggre- 
gated calculations (Rodberg 1978; Brooks 1981:154-167], have shown that effi- 
ciency and soft-technology investments provide several times as many jobs per 


kW aS power-station investments, but better distributed by location and occupa- 
tion , Congressional Research Service 1978:212-219] and arguably offering more 
scope for individual responsibility and initiative. It is partly for this 
reason that manv progressive U.S. labor unions (e.2 United Auto Workers, Aero- 
space & Machinists, Sheet Metal Workers) support soft energy path." 

Another important consideration is the program's macroeconomic effects via 
spending patterns and interest rates. ‘(Respending effects--how people spend 
the money they save Sv using energy more efficiently--are important to the job 
anaivses. In general, efficiency and soft-technology investments are counter- 


inflatiomarv: once in place they provide energy services at little or no 


additional cost, rezardiess of the price of depletad:ie fuels. The reilativeiyv 
, ; ; 
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Ort construction time and fast payback of these investments also tends [0 
reduce pressure on iaterest rates. Kahn ert al. [1980' have shown explicitly 
thac an electric utility in financial difficulties (Appendix A) can increase 
the present value of its cash-flow severalfold by cancelling long-lead-time 
plant construction and spending the money instead on efficiency/solar invest- 
ments, which turn over money very quickly. The saving from those investments 
is not only immediate and continuous; it is also widely distriduted throughout 
society rather than concentrated in a few industrial sectors or localities. 

Efficiency improvements and soft technologies have very much lower and 
more manageable risks to occupational and public safety [Holdren et al. 1980) 
and to the environment generally [id.] than do competing nonrenewable sources, 
even with stringent controls. A combined strategy of efficiency and renewables 
offers a potent way of avoiding global climatic change [Lovins et al. 1981]. 
And if coupled with recognition of the economic realities of the utility and 
nuclear sectors and of the problems posed dy the strategic arms race, such an 
energy policy is also the most effective means so far proposed of Limiting or 
even reversing the proliferation of nuclear weapons [Lovins & Lovins 1980]. 

Other geopolitical implications of such a strategy are also important. 
For example, both directly and by example, it could strongly influence U.S. 
allies towards a more sustainable energy policy: such countries as Britain, 
France, West Germany, and Japan all turn out to be able to provide essentially 
all their energy services using presently available and cost-effective effi- 
ciency and renewable technologies [Lovins et al. 1981]. The attractions of 


such technologies for developing countries have been extensively documented 


’ 
' 


[id.; Lovins & Lovins 1980]. The Office of Technology Assessment [1978] has 
noted (Congressional Research Service 1978:199-209] the special advantages of 
independence from fuel and technology imports. “Solar energy is the one energy 
resource which is reliably available worldwide"--generally in larger and more 
consistent amounts in most developing countries than in the U.S. [id.:204], and 
competing with far higher than U.S. fuel prices. The advantages of soft tech- 
nologies for rural-based development, for integration with agriculture, and for 
simplified versions using locally available materials would be especially 


striking in developing countries .:208; Lovins et al. 1981]. One result 


~ 
_ 
3irectly relevant to U.S. security would de the partial relief of the Third 


world frustration and desperation which could otherwise serve as a Dreeding- 


ground for revolutionary doctrines. 


— 


Similar arguments apply within American society itself. Technologies 
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which tend to improve distributional equity, which are equallv availadle to 


» which increase individual and community selfe- 
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which, after the investment of enormous technical effort and hundreds of bil- 
lions of dollars, finds itself with no vendor in the world that has sade a pro- 
fic on reactor sales, with act least fifty more reactors cancelled than ordered 
in the U.S. since 1974, and with a similar collapse of prospects througnout 
the world’s market economies [Lovins & Lovins 1980]. This unhappy episode 
underscores the risks of underestimating the challenges of “biz engineering” 
.Bupp & Derian 1978], assuming that capital markets will indefinitely ignore 
the boctom line, and neglecting the social realities that make it more diffi- 
cult to achieve a plutonium economy than to insulate houses. Although it may 
at first glance appear that the “hard” technologies require merely continuing 
to do as one has previously done, while the alternatives require striking out 
into new territory, a pragmatic assessment of what is actually working tells 
the opposite story. The contrast between one set of technologies, failing to 
meet the test of the marketplace despite lavish subsidies, and the other, 
capturing the market despite discriminatory institutional Darriers, could not 
be more complete. Efficiency and renewables are not only the line of least 


resistance but also the policy of least risk. 


7.2.3. System integration issues. 


A full assessment of inherently resilient energy sources must consider 
what opportunities and problems may arise as such sources are gradually inte- 
grated into an entire energy system, combining them with each other, with 
existing energy devices and networks, and with other infrastructure such as 
Suildings and farms. Although such issues can decome exceedingly complex, we 
shall highlight by illustration some of the possible forms of integration that 
can improve svstem economics. 

we have already mentioned that renewable space-conditioning systems, espe- 
cially those using passive solar techniques [Department of Energy 1980; Cali- 
fornia Energy Commission 1980], can be integrated with other features of a new 
Or existing building so as to save materials and money. Attached greenhouses, 
for example, can provide most or all of a house's space heating, a frostproof 
site for a solar water~heater, a cheery "“sunspace” that extends living space 
yearmround, and 2a place to grow food in ali seasons (OTA 1981; Yanda & Fisher 
1980]. In such a building, simple plastic-composite sheets can de used to form 
freestanding water tanks, usable both for heat storage (as passive-solar "ther- 
mal flywheels”) and for aquaculture. In ome Cape Cod design, each tank pays 


for itself annually by its oil saving or its fish production, with the other 
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mction provided free. Some houses are now integrating food production with 
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water recycling or sewage treatment: water hyacinth treatment plants, now com 
Mercially available {OTA 1981], provide better water quality than costly and 
2nerzy-intensive tertiary treatment plants, while sequestering heavy metals and 
Droviding a feedstock for producing methane fuel and fertilizer. 

The opportunities for multiplying functions and saving energy and money 
are almost unlimited. A dairy farm in Pennsylvania, for example, like others 
in Europe, uses an anerobic digester to convert manure to an improved fertiii- 
zer plus methane gas. The methane runs a diesel generator which powers the 
farm (many such operations produce an exportable surplus). The generator's 
Waste heat makes hot water to wash the milking equipment (some farms use it in 
pasteurizing). Waste heat from the washwater is then recovered and used to 
preheat the cows’ drinking water so as to increase the milk yield. A further 
project now being pursued will integrate these functions with on-farm produc- 
tion of fuel alcohois from crop wastes, cascading process heat and sharing 
other infrastructure, then using the alcohols to run farm vehicles and to sell 
as an additional export. Another common form of dairy-farm integration is to 
heat the anerobic digester in the winter with waste heat from the milk chiller 
\a giant refrigerator, legally required in many states). This often boosts the 
methane yield so much that one tarm's output can ceet all its own energy needs 
--before efficiency improvements--plus those of six other farms. Still another 
common pattern integrates the wet or dried residues of alcohol distillation 
into the feeding cycle (the high yeast content makes it a premium, high-protein 
feed). The carbon dioxide from fermentation can also be sold to refrigerant or 
soft-drink companies or used to increase the food output of a greenhouse. 

Similarly ingenious--and thriftv--cascading of heat through a series of 
tasks at successively lower temperatures is the principle of industrial cogen- 
eration [Williams 1978]. This energy- and money-saving technology [Machalaba 
1979) replaces two separate boilers--one in a factory and another in a power 
$tation--with one in common, producing process heat or steam with electricity 
as a byproduct. Three-fourths or more of the energy in the initial fuel is then 
harnessed, not just a third. Air-conditioning or desalination can be further 


byproducts [Diesel & Gas Turbine Progress 1973]. 





The same objective can be achieved bv using for space-conditioning the 
low-temperature waste heat from a plant used primarily to generate electricity. 
Some such systems (Energy & Defense Project 1980:197-159) achieve about 90% 
overall energy efficiency, are designed at the scale of a single apartment 


Nouse, and use standard automotive engines burning a wide range of liquid or 


gaseous fuels. Current prices are about 310,000 for 15 kWe + 38 kwWe | Popular 
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S , Making the systems attractive despite their limited Lifetime. 
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Eicher kind of cogeneration--using low-temperature waste heat from a zen- 
erator or using 2 topping cycle to make electricity Ddefore using high-Cempera- 
ture industrial heat--can also be used with renewable enerzy sources. For e#x- 
ample, the medium- or low-temperature waste neat from a low-ratio optical con- 
centrator (which can improve the economics of solar cells) can offer an addi- 
tional economic credit for domestic space and water heating, as noted delow. 
Aigh-ratio optical concentrators to make igh-temperature solar process heat 
can make electricity first, just as if the heat were from a fossii-fueled doil- 
er. Such solar process heat is also well suited to increasing the vield of 
Dioconversion processes, as Prof. Michael Antal of Princeton University has 
noted. Prof. Sven Eketorp (Royal Swedish Institute of Technology, Stockholm) is 
even exploring modernized steelmaking with charcoal from wood: with no sulfur, 
the steel is of better quality, and copious fuel gas is a free Dyproduct. 

Still another integration opportunity arises where wood wastes are Surned 
for industrial cogeneration--an increasingly common practice in the forest pro- 
ducts industry. It appears possible to cascade process heat to produce methan- 
ol as a cheap Liquid-fuel byproduct from some of the “junk” wood input. This 
could also be done in the kind of small (tens of Mwe) wood-fired power station 
proposed for some northern states and eastern Canadian Provinces. Indeed, if 
properly sited, such plants could simultaneously produce, at much reduced cost, 
electricity, methanol, and space heat, thus replacing all three of the main 
local uses of oil. Such an arrangement, like industrial cogeneration, obvious- 
ly increases the resilience of the power grid by adding a diverse, localized 
source that can operate in isolation. The increasing use of cogeneration in 
o1l refineries also reduces possible spillover of electric-grid failures into 
the oil system. Proposed uses of solar process heat in enhanced oil recovery 
would offer the same advantage, and are encouraged by overlapping tax subdsidies 
offered both for the oil recovery and for the solar components. 

We have referred several times to the use of low-temperature waste heat in 
Suildings without mentioning that this can readilv be done not only at the 
scale of one or several buildings but of an entire town or city. This is com 
moniv done in Europe, and especially in Scandinavia. Sweden, widely regarded 
as the leader in district heating technology, is in the middle of a ten-vear 
program of converting all cities of over 190,000 to district heating (Stockholm 
will take twenty vears). This process is using special institutional and tech- 
NMical innovations. The latter include highly insulated flexible pipes which 
cam 35e laid relatively cheaply over large areas, even at low suburbdan Jdensi- 
ties, tO carry pressurized not water. (Steam systems are usually considered 
Obsolete.) Many Swedish Ddoilers providing district heating, with or without 


electricity, can burn a wide range of fuels, including municipal wastes and 
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wood chips. Cheap backup boilers are also commonly provided to ensure reliable 
Service, and there is usually redundant pumping capacity. An experimental 


, 


Soller at EnxS3ping achieves extraordinary fuel versatility, with high effi- 
ciency and cleanliness, through fluidized-bed combustion. The Swedish DSistrice 
deating Association has shown great foresight Dy recommending that new district 
Neating svstems de designed to de easily convertible cto solar district heating 
later. Several solar district heating systems are in operation or construc- 
Cion, tainivy in Scandinavia [Margen 1980; Gleason 1981,1981a,19815!. 

Several analyses have found that solar district heating can cut the deliv- 
ered cost of active solar heat roughiv in half [Hollands & Orgill 1977; Office 
of Technology Assessment 1978]. An analvsis of the physics involved [Lovins 
1978:492] found that a large water tank, shared between tens or hundreds of 
dwellings, provides (in comparison with a single house's small tank) a large 
volume-to-surface ratio, hence low heat losses; has low marginal cost per unit 
of volume; and has a favorable ratio of variable to fixed costs. One can there- 
fore afford to use several m of storage volume per m¢ of collector 
area, rather than a ratio of typically 0.5-0.8 in single houses with quasi- 
seasonal storage, like the Saskatchewan Conservation House. The increased stor- 
age volume then provides true seasonal storage from summer through winter. This 
in turn provides a full summer load, improving annual collector efficiency. It 
permits further efficiency gains dy separating the storage volume into differ- 
ent zones with the hottest water near the center and the coolest near the peri- 
phery: this improves collector performance and further reduces heat losses. 
Finally, true seasonal storage makes it possidle to orient collectors east or 
west rather than towards the Equator with only a small performance penaltv, 
simplifying urban retrofits. The net result of all these effects is a marked 
cost reduction, probably to levels well below the oil prices of a few years ago 
(Hollands & Orgill 1977]. Incorporation of solar ponds (Chapter 7.3.2) or ice 
ponds or doth |Tavlor & Tavilor 1981] would cut costs still further, and would 
incorporate energy collection and energy storage into the same device. 

People unused to thinking about the variability of renewable energy flows 
aften assume that integrating renewable sources into the existing energy svs- 
tem, especially the electric grid, would make service less reliable because 
many renewable sources are intermittent, dependent om vagaries of weather. This 
intermittence is presumed to require full conventional backup ‘negating the re- 
Newadle sources’ ostensible capacity saving), ofr enormous amounts of energy 
storage, or doth. In fact, as noted earlier, renewable sources even in a small 
geographic area tend to complement each other, and their interruptions are 


4 , . . > . . 
Sriefer, more predictable, and quantized in smalier units than the interrup- 








ee | 


-_-"* 


tions of conventional sources dw technical Dreaxdowns, oi! embargoes, strikes, 
3 


etc. This nas Deen Dorne out Sw Sertailed analvses “ahn 1975,1979; Serensen 
1979; Diesendorf 19381; Systems Conrrol 1980!. 
Indeed, viewec swore DSroadly, the need for energy storage is a far worse 


Srodlem in conventionally projected svsteas. heir reliance on extensive cer- 


tral electrification requires [Rvle 1977! vast amounts of very awaward and 
costly electrical storage. In contrast, with economically efficient energ: 
sse, electrical demand would 5e so greatly reduced (Appendix A) that the grid 

wouls be dominated bw present and small-scale hydroelectric supply, permitting 
storage in the form of water behind dams at no extra cost. (Kahn [1978,1979) 

notes, however, that in such a system the optimal ratio of the dams’ peak out- 
put capacity to their ispoundment volume mav well change.) Liquid fireis store 
tremselves. Heat storage for davs or weeks, in rocks, molten salts or setals, 


etc. is straightforward [Office of Technology Assr :sment 19738] and not unduly 


‘) 


ostly--given efficient use. In short, an economically efficient combination 

9f investments in energy productivity and renewable supply can reduce the 
<a 

energy storage problem from the intractable levels which reliable service would 

demand if oresent policies were pursued. The storage which would be needed in 

a soft energy path would tend to be relatively dispersed and invulnerable. 

The fost complex integration issues, extending well devond traditional 
reliability considerations, arise with electrical svstems--both because of the 
need for grid svnchromization and because electricitv, being generated and used 
at essentially the same instant, requires rapid regulation to ensure a dalance 
Setween fluctuating demand and fluctuating supply. Hardware is moving so such 
faster than analysis that we alreadv have attractive dispersed electrical sour- 
ces (such as cogeneration, microhvdro, and wind), and shall soon have sore 

such as competitive solar cells), before we xnow how best to use them. There 
is a legal frameworx--notadly the Public Utility Regulatory Policies Act of 
1978--encouraging the interconnection of such sources and compelling utilities 


to buv back their surplus power at the utilities’ own “avoided cost” (Promoting 





Small Power Production 1981], and specific technical arrangements for inter- 





, 
' 


change are starting to emerge (|Sun*Up 1981). Some utilities (e.g. Southern 
ee 


California Edison Co. 1980] are already planning to put numerous renewable 


Jevices of their own onto their grid. Yet the optimai method of commecting and 
3$i1NgB Cnese sources is Wot vet «<nown. Should thev Se integrated with the grid, 
Sf isolated from ite-providing local storage and operating end-use devices on 
Lowevoltage OC? This is still an open question. 

Some previousiv controversial issues lave recently Deen settied: for 
example ,Svstems Contro! 1999,19905,, Sw showing row to ensure the safety of 
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ectionms that mignt de energized dv iispersed 
Nv such sources w:.1l sot damage the gr:c¢ or 

MS 29 avoid feeding damaging harponics ints 

. theoref:ica. and practicai questions re- 

AC inverters have Seen uses for secaces 22 
some of America’s cumulative total of six 
g-connected, sere.vy Navinzg feasid!l2 metnocs 

—_—_—_———— 
$$ amowing which saethods are Sest wnhere. 
lex than Bav af <cirst appear, partiv Secause 
ecting sources and gric .1¢.; Svstems Con- 
—_——_ 
generate electricity as low-voltage DOC, e.z. 
a DC generator, perhaps Suffered Sv storage 
ent can tnen oe Sptiomaliv convertec te 
° 
This can de synchronized bv the line volt- 
the line voltage as srocessed through a 
satile method); some inverters also produce 
even if not comnected to the grid. Alterna- 
ate AC directiv using a synchronous or in- 
980:5-15 ££,. The former, the tvpe used in 
rotation af a constant speed (3600 rpa 
im the generator), Sut if can operate and 
srom the grid. i: can de connected with 
, and phase angle are first matched to those 
m the other Sand, must de driven slightiv 
pthemwise chev run Sacawards as motors), $0 
f the gric, Sut thev go sot seed to Se svn- 
, and are simpler and cheaper than svynchro- 
me must msider the source's relationshis 
"se cevices am genera., #@iectronics anc 
electroplating, require low-voltage OC and 
na and filtering AC from the arid Sonsgumer 
heaper anéd their weight and copper consump- 
“f9-DC sowef 8499.18 wer mitted zZivecr 4 
; » * . “ ers. 4erer a” ° ‘yoe, ta 
t? : gome BoCOPS require it at fixed 
' ’ 
«| » Si1° 4 Ve erate feo *se « 4 
yr some $0 S$ wind machises use tris 
. >? 4 "fae neA*y d ao ‘4 “ws .ac . 7 ‘ 
92 @.2. waening ma mes, 8 me 35 
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n small sizes, tend to be relatively scarce and expensive 
the treditional source), Dut inventors at NASA and else- 


plug-in solid-state “smart inverters," now entering the 
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the incremental cose of DC motors, which enable stan 


y efficiently on low-voltage DC. Incandescent lights run 


Ziven the rignt voltage. Fluorescent lights normally use 


new versions use their own AC-to-AC or DC-to-AC inverters to pro- 


vy (400 Hz and up) output which boosts efficiency. (Hand- 


camping lanterns are of this type--hence their aign-pitched 


An AC generator requires the least adaptation of standard household 


equipment but tends to encourage or +-ven require grid integration 


ls economically optimal or not. A DC generator can operate DC 


fice 
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ly; can opera 
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>, sells in Japan 


such as most electromics) and connect to dattery storage 


e AC end-use devices through a small inverter, such as 

to operate household appliances from car or boat current; 
the zrid via another inverter. which approach is optimal 
on local circumstances, especially the proposed end-uses. 

chnical problems of grid interface [Systems Control 1980] 

solved bv harcware on or aDout to come on the market, 

ittle attention to integration and 


issues. This is likely to be corrected as more solar-cell 


There is currently rather a narrow range of inverters on 
common models, such as the Gemini”, were designed for wind 
I 


lar cells. Better designs exist: 


but not in the U.S.) a chip-controlled 
ally generates a 99*%-pur2 sine wave and responds in a 

to anv change in the size or reactance of the load. The 
esign inverters for U.S. nuclear weapons are also turning 


nverters for renewable energy sources. The market range of 


inverters, including those amenable to remote control by 
therefore lixely to increase rapidly in the next few vears. 


ver, 2e© a compiete solution to the broader problem of making 


, JC, or Aavbrid svstems emer: 


f dispersed renewables to reduce the vulneradility of the 
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Dreparedness issues. Three issues stand out here. First, there is little ef- 
fort at standardization, and different manufacturers mav end up making incom- 
patidle equipment--restricting opportunities for improvisation and for moving 
2quipment from ome site to another in emergencies. Second, manv preparedness 
Dptioms are being ignored: no thought seems to have deen Zgiven, for example, to 
making DC voltages and hookups compatible with automobile electrical systems; 
Droviding accessible and foolproof terminals (and instructions) to facilitate 
such emergency interconnections with a car battery or alternator; designing 
Zrid inverters and controls to be resistant to EMP damage (p. 96); and encoura- 
Zing desizgns which, without endangering utility personnel, can operate indepen- 
gently of the grid, serving local loads in isolation. On the contrary, present 
practice, to protect utility personnel in a way better achieved by isolation 
relays, encourages induction-backfeed generators and line-driven inverters-- 
guaranteeing that if the grid crashed, renewable sources could not operate at 
all, even to serve local loads. Third, although current standards of grid 
reliability exceed any economically worthwhile value [Telson 1975], and relaxed 


reliability standards would improve still further the economics of intermittent 


" 


enewadle sources (Xahn 1978:338f], Little thought is being devoted to seeking 
more sensibdle reliability standards better suited to heterogeneous eeds*. 
Dispersed renewable sources can prevent or mitigate cascading grid fail- 
ures only if proper attention is paid at an early stage to how they are con- 
nected into it. The importance of these issues is emphasized in a major ana- 


f 


lysis of such sources' role [Svstems Control 1980]. The study found [ :5-50] 


that "There is no question that [thev!...would have helped greatly [in the July 


Ly New York Dlackout! provided that they had been properly integrated into 





the power system under conditions of cascading outage. This means that fail- 
sate procedures must exist to ensure that [the dispersed sources]...continue to 


function...and are, in fact, connected to the essential loads, e.g. buildings, 
zOvernment services, traffic lights, etc. Corwin et al....escimate that the 


economic loss caused dv the disappearance of these essential services constitu- 


tuted roughly [383% of the direct losses in the New York blackout;....The total 
demand for essential services is estimated to be in the range of several per- 


3~ 


os 


cent of total demand. Thus, [in New York] several hundred negawatts of id 





wUses requiring aign reliability could get it more cheaply with local storage 


Sr standdv capacity, as telepnone excnanges, hospitais, et>. do now: it is 

cheaper to provide extra reliabilit Nn some places than maximal reliability 
everywhere as in the oresent grid. Similar considerations apply to voltage, 
frequency (pd. 47 and pnase stadilitv. In an era of cheap digital electron- 


ics, it no longer makes economic sense to use the grid as a universal c.iock. 


Yet new CurbdDogenerator designs are locking us into extremely stringent stand- 
ards for decades £5 come, complicating the interface with renewadles. if it 
turns out that phase and frequency stadility need to be "stiffened" in a grid 
eventually cominated dv large aumbers of independent renewadle sources, noftor- 
generator sets with large flywheels mignt suffice: angular moment. 1s cneap 
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nt nave prevented the loss of essential services. ( 


ts 
ry 


was the failure of traffic signals and street Lighting wnicn “facilitated 
looting, caused traffic accidents, and immobdilized law enforcement.") 

The analysis notes {:5-51] that "Alrhough major restrictions affecting 
generation resources such as nuclear moratoriums, fuel embargoes, snutdown of 
all plants having the same design deficiency and strikes” have not been con- 
Sidered in past utilitv reliability calculations, they may de very damaging 
Decause of tne large number of generating units that could be affected simul- 
Cameously." If such disruptions caused the expected outage rate to increase 
from one day per decade to ome week per decade, a standby source with an annual 
cost of $60/kW could well be justified, because outage costs might well exceed 


its break-even point of $ll/kW-h [id.!]. But for the dispersed sources to be 


Al 


most useful during a supply emergency, it is essential that there is a priori- 
tv load allocation scheme as well as supervisory control systems and other 
Nardware to ensure that the system can, in fact, be operated according to this 
scheme. In the absence of priority allocation, essential loads might be cur- 
led while non-essential loads continue to be served. Im addition, the [dis- 


persed! ...zenerator could easily be disconnected from the svstem by its over- 


rr 


load, undervoltage, or underfrequency protections. Individual operators 0o 
Jispersed sources night also need some wav to limit their own loads to essen- 

tial uses in order act to overload the isolated source; but then idle capacity 
available to the user might not get into the rest of the grid in its moment of 


need [:5=5 mother unconsidered design requirement in 
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wadle sources. Although Svstems Conrrol, 
ct om priority load allocation for 
entire grids, such measures are verv far from realization, and virtually no 
Location on the scale on which a small 


t be used and controlled. 
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in summary: adequate means of integrating all availabie renewable svstems 
into the electric grids, and other parts of the energy system, are available. 
Further analysis and action are urgently needed, however, to determine which 
whether end-use svstems should be modified to reduce tota 


[Osfs, and now to sesizn and organize the dispersed sources for greatest dene- 
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The immense diversity of appropriate renewable 
tions of them, their range of complexity and technic 


2xtremely rapid pace of their development make anv a 
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Onomic status ephemeral. An early review 


Novemder 1977 needed half its data changed dy March 


2) 


ources and hybrid Ccom).ina- 


q 


al sophistication, ana the 


1978 


nad Decome oDsolete by the time the proofs arrived in Mav. This moving target, 


nowever, is generally moving in a favorable direction--either lower reai costs 


Or a lower rate of real cost escalation than nonrenewable competitors--so aot 


Deinz completely up-to-date mav just mean omitting recent zood news. 


As Chapter /.1.1 showed, economic comparisons a 


ro 


t is especially risky to compare data calculated by 


-~ 
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ause they may use different accounting conventions 


-3.1. Economic status of soft technologies at the margin. 


re fraught with pitfalls. 
different analvsts, bde- 


or degrees of conservatism. 


The assessment just mentioned [Lovins 1978], for example, whose economic re- 


sults are summarized on the following two pages, used consistent conventions, 


and ensured that the conclusions were weighted again 
- no real cost escalation for anv source after 


low prices for nonrenewable svstem 
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pS LOVINS 


ie 1 bbi/day [~ 67 AWG! cathaipy to US comsumers* 


1976 $/ form 


bictey syotom (bbl - day)” supplicd® 
Hlasd tcchnulopics 
biadtteonal durcct fucls, 1950s5- 1yoUs4 
4 cdutect Coal, 1970s 2-3, WUU I 
North Sca ol, late 19/054 10,000 " 
(US tiaontics ot snd gas, 19YSUs 10-25 000 ! 
Syauthectics trom cual ut shale, 1980s 20-40 LOU }- 
tcutisl coal clectin ¢ sxaubbers, 1980s 170,000 | 
Nuclear clectrae CE WK), mid-19805* 235 UOUFt I. 
Pecthmiual biacs to Mbipmuec cnd one cilhoreney 
Now commecrctial bushdings -3, 000! HE) 
( ion todustrial & architectural leak plugging, 
bettce home appliances v0 ~5 voo! lik 
Moot hcat-iccovery sysicis 5-15,000! i 
Hottoming cycles, betics motors! 2u0u8 | 
Worst case, very thorough buthling retrotits iw voo! i 
Li sssotticonnal fossil-fuel tes hinologics 
( oabktivcd (undized- bed pas turbine with destrict 
heating and heat pumps (COP - 2), catly 1980s ju 000! TH 
Most trdustrial cogenciation, late 19 ust 60 000 Lil 
Soult technologies 
Passive solar heating (6 100%) < UV 2u,ouot i 
Ketrotithed POUL sulas space heat, mo bac hup 
needed, 1OO-unt neighborhood - 20 40,000! hee i 
Samic, single house, mid-f9 Bis ~ 5U- 10,000": : i 
SUC salar process heal, Lysol 120,000 i 


Collection and bioconversion of lara and 


lotestry Wastes to lucl alechols, 19Y8U ~ 15-25 (WU ! 
Pyrotyets of mhuntcipal wastes, L980 30,000 ! 
Mi toby drocte clin plants 30-140 000 | 
Solar pond and Kaukine cagine™ 120, 00U & I 
bt 


Wad clecim plants” - 10-185 000 


“late destwed tn (2) chapters 6-8, sce elso chapters 1, 3, cacept as noted in footnotes 
gobo t, anden eand conservation costs [derwed from a wile range of literature, partly cited 
ms (25f 

"Leepeteal data cacept syntuchs (propected), Nuidized bed gas turbine (price of turn 
hey htoe) and solat neighborhood Neating (luoowtmote h) 

“4 tivcl, t cleatsitty TL teat 

“Not aaspinal, inctuded only as baseline for Comparson 

“Leow detath, see (2) chapter © UMaretly, assumes 11-..Wle) LWK ordered mm 1976, ata 
pre of SSBS pes wet witalled KW C1974 §, Bechtel data) Converted to $929 (1976 §) 
with the Hupp A tremtel curtcat dullas tedes of 1 260/yeat Meal escalation alters 1976 as 
sured tu thee cet Marginal fuct cycle, transmission, and diotrbutton tuctites priced re 
spectively af BOL, S609, and SA2070W C1974 6, Bechtel deta), converted to $76, $66, and 
b5 25 tespectively (1976 $5) with the 1.25 Mershall & Stevens Equipment Cost mien. As 
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fable 1 Approxunate marginal Capital investment for complete energy systems deliver- 
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SOFT ENERGY TECHNOLOGIES m@&> 


Table £ (Continued) 

sumes front-cad cost of $100/hW (1976 §$) for matial core Lotel mvcotment, $1,710/ 
kWic) wmstalied, converted to $3,120/kWie) scat oul by dividing by 0.55 nominal capac- 
ily tactos, then to $3,49S/hWic) dcliwered = $254, 500/(LbI - day) cuthalpy deliwcied by 
surcharging 12% tor cquivalent 16.7% losscs ms tansensivn and ditibutiwon These dats 
are generally conservative (tow low), Omitted costs mnclude marginal capital tavestmcal 
in land, rescrve margin, federal regulatory and sccunty services, fedcial KAD, future sce 
vices (waste management snd decommissioning), end cud use devices; allowance fur teal 
cost escalation efter 1976 (prescatly about 20% /ycar for LWKs and TH /yecas tot cual sta- 
tions), the 6 $-8°% of output necded to upetate the tuct cycle, and all caternalitics and 
dynam act-cncigy considerations. Includmg teslistic cotumates tor all terms (caccpt the 
last two and cnd-use devices) might raise the total tu 2 $5,000 /bWic) delivered 

Nacludes the olten high coat of end-use devices. An unpublished 1976 Shell analysn 
calculates typical mvestmeat per bbijday used of the order of $120-200 O00 tur a 
Lusopean car, $35,000 for a Conventional huuse heating system, $5-10,000 tor indus 
trial bowlers, and $14,000 tur a blast furnace 

BCalculated trom the review by G. N. Hatsopoulus, T. bt. Widmer, L. Po Gyttopoutles, 
and KO W. Sant, A Natlonal Polucy for Induswial Energy Conservation, published by 
Themmo-bLiectron Corp. (Waltham, MA), 22 Ap! 1977.) Assumes that both tuppung and 
bottoming cycles use both process heat end clectinity taside the plant, avoiding marginal 
tuvestment im clectic dutmbution tacthitics 

ME stumated from fulluwing cuntsy end (55), with catra slhuwance fos heat dntribution 
im fatcty low denmatty settlements 

‘Assumes thal, m accordance with cConumkK priorities, stringent heat conservation 
measures have been applied turst. Assumes traditional tat plate collectors (nol mtcgraicd 
miu buslding tabric) with scusible heal storage m water m ™ b25/m3 tanks of modular 
concrete slabs (70) bor cloudy high Jatitude sites (ce g Scandmavis), add about 40% to 
upper valucs. See (2, 68) and discussion im teat. 

Metal price $118jm? (7) for 315°C, 0.44 cffxcrcat Winston collector, inatatlation 
price $22/m2 See alsu teat 

hi actudes mvestment credut for byproducts (ce g material recovered) and for waste 
disposal services replacd Much lower costs are possible. specith mvestment fut latom’s 
mobile pyrolyzer (teal, footnote 14) a approatmately five thes lower 

'iased on unpubluhed draft cstemates by CLO, MITEL, and New Lagland Kegronal 
Con masston [§5-1,200/bWic) installed with average capacity factor ~ 06-0 7], So des 
trtbution loss, and scto marginal enemission capacity (owing tu old lives ttl avarleble 
at old dam sites) See Mucttes, 3) 1978. States, Potential and Problems of Small Hydro 
electra Power Development im the United Stutes Unpubloted tepurt to Miesdent’s 
(Counc on Lavioamental Quality, Washington 1 66 pp 

Pond costing $i0/mé with UO 6S elliteny, Kanhine cugme plus local dotitbution 
(sce teat) SH00/hWie), 10% engmme effactemy (Consetvative, as the pond should ytd 
90-105°C. not 80°C), 4% dutribution boss, O95 capectty factor using heat storage m 
pond Land cost nut tncluded & 

"Upper valuc trom Kisager 22.5 KWle) machines, lower from run on Schachle 3 MWe) 
machies, at S7OO/KAWip) and S20S/KWip) respectively (1978 $, sce teat), deflated tu 
19760 $ with O 87 mdes, fot both, 0.5 capactty factur, 4% ditribution boss, end « thud 
oft the ~ S$ 360/khW S600 VAC distribution mvestment sssumed marginal Storage mvest 
ment omitted, based on tuclt of water-saver opetativon wm a hy dtu peaked grid (vec teat) 
fen hour storage -sulfnrent (117) to make « typual Danish wind machine mtu as col 
able @ source of tim power ase typical US LWK— might add about $160 2 bu per bhWie) 
sent wut to capital cost and hawe 20-30% bosses In practice ts very doubtful such stor 
age would be needed See HW Syrensen, The Kegulation of an blectrnity Supply System 
Including Wind tnengy Generators, preponat fot Second lat) Coat on Wind Energy Sys 
tems, Amsterdam, 1976, and t Kahn, Keltalility of Wind Power from Dispersed Sites 
A Preluninary Assessment, nalt Kep. No LULL 6869, Lawrence Detheley Latunatory, 
April 1978 
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lable 2 Approstmatc price of dclweied cacigy trom vaitous US encigy systems® 


ae eee 


1976 $/bbi 
crude oll 
lype System 1976 ($/G3)” equivalent”: © 
Kaw tucts4 natural pas 19 il 
coal 21 12 
no 2 tucl ol 28 io 
propane 44 25 
taxcd regular gasoline $3 31 
chutimnily 5.7 $1 
Space heat nuproved cnd-use citictency © -0.2-14 -1-8 
UU wl (ncighburhood y! 12-25 7-14 
natural gas" € 28 16 
no 2 tuct ol. 6 41 24 
100% sulas (house i! 2941 16-24 
high KEU syngas” 50-64! 29-37! 
LWK/heat pump? 74 43 
LWK/ieststive® 17.5 101 
Process heat coal! 28 16 
hiyh-W1U syngas! ©! 62 cr 
j00°C Winston sola™ 3 43 
Ptusd tucls bioconverston” 14-48 8-28 
blectrnnty wiictohyadtoctatiuc” 17-80 10-46 
what pod sil Kankine engine? ovx 40 %* 
wind 10.5-17.2 61-100 


Iw 175 101 

*Mustsstive valucs based on Table t and anumptions noted below 

UMurginal prices cacept as noted tn lootnmote d, capital tavestmecnts Converted to capital 
componcel of cucigy prices at O Il /year fined Charge tate, which ts high (therefore un 
tavutable tu renewables) for the constant dollar eccounting used here, bearing im mind 
thal ulilifics Mm come Lan on tevenucs from matginal mvestments gcretally cero of mega 
tive (L7G) 

“lL quivatent crude off af $5 GJ/bbI converted at 1.0 bint Lew efficiency, e.g im prac 
the (loutmote g) the LWi/heat pump system would compete with $45 % 6 7 = $30/bbI 
ott (neglecting ‘elining) 

J Approamnate avetage of US tegtons (not wetghted by consumption) at end of 1976, 
Hot matginal bul shown a3 baschine | uropean pitces tend tu be much higher 

“Aggtcgation of categuttes in table 1 

TAssumes average US tnoctation (180 Wm? everaged over ali states of the carth's to 
tatton and otbit), fot cloudy bigh lattlude clomates (e.g Scandmevia), add about 40% tu 
higher valucs Assumes catremely energy elfictent butidtings tetruofitted with msulation 
and secupertators beture solar system. Med- 1980s sulat system matalled price $100/(m2 ‘ 
mm) and sterage U 4-05 mF jon? cotlecton fos single howe. Lower prices are possible with 
mthowatll © collectors of thew bothdings Assumes 10¢/G) for operation and man tenance 
((9RM) 

fiuct ane es ahuve, tree furnace with 0.7 birst Law efficiency ond 2% O&M charge 

MW Assut es g4> syotem capetal cost $40, 000/(bb1 + day) deliwered, working at 9O'% ca 
pacity tactot, S7g/G) minemouth coal converted of S604 efficiency with operating costs 
(loss byproduct credits) of 1Og/t.) and same delivery Cost tn tree pipelines, no water con 


iiatits, Combustion a. in luutmute ¢ 
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Table 2 (Continued) 


“tigher value sssumes that furnace and pipeline are assigned mar gimal capital costs wf 
28% and « comscrvative 95¢ pet GI tespectively Gas prices shown atc probably Z8ijesd 
tow low. 

iecticity price trom footnote k, $208/kW(c) heat pump with an avctage and winter 
peak COP that equals 2.5 (cauggcrating the probable capacity saving by « factor of 2-5, 
since must heat pumps have a COP of spproatmatcly one and add tcamtence heaters on 
the coldest days); 2% OSM 

hiuct cycle cost af cmpencal burnup (credited for miteal Core), OSM, end teacs tor 
station Conmservatively assumed tu be 7.2. 1.5, end O 4 mb /bW he respectively, © mb jaw 
he fos OSM on transmnswn sed dntribution capacity. Delwered chatinmuy pre, 63 
mS$/kW he, ts conservative for reasons caplamed m lable 1, loutmute ¢, and because Hon 
nuckea (cg peashmg) plants, allegedly mtcrur m the ment order, would produce cven 
mote capensive clectrnuty. Present clectsuutly prices ate typically somewhat below this 
level in induatsss! Countrics, several Limes 1 in maay developing Countrics 

lAssumes $5,000 /(bbi - day) tuct used furnace with O56 buat Law cificicacy snd 2% 
OSM. Coal price from top of table & current, nut long tun marginal 

“Assumes (lable 1) wnitalled price $140/m?, with 160 Won? avetege insulation, 0 44 
borst Law efficsency, 2% OSM, and SOg/G) buller storage (includmg Us looses «9 an 
cquivaleat surcharge) Mighly sciective flat plates of tubes —especially with « ruul replace 
ment credit—would probably be cheaper. 

"Marginal collection and operating Costs $0.$-3 6/G) net output 

“Lower valucs charactertitic of sites with canting dams, higher, of derelict of run of 
the river sites 

PAssumptions a3 im lable 1, footnote m, plus 4% O&M. Lhe capital cost of the engime 
1$673/kWic)] & close to the 1978 Kinetics Corporation price deflated tu 1976 $ (~ 3700, 
sce teat) and well above pres capected tor mass production (27). 4 

GKange of Capital Costs trom lable 1, edding 4% OAM and 10 hows of storage ot $50/ 
kWied he. The storage Cost component is $6 3/6) Wind clectintty mitegrated tate shy dro 
giid (lable 1, fuotnote a) theretore around the $4 2-10 6/6) range 





Reterences to fab | es 


(2) = [Lovins 1977b]. 

(7) = [Crimmer & Herr 1976]. 

(55) = [Hollands & Orypill 1975]. 

(68) = Lovins, A.B. 1977: letter of 1/7 March to U.A. 
Bethe, reprinted at 486-492 in U.S. Senate, 
Select Committee on Small Business & Committee 
on Interior & Insular Attairs, Alternative Long- 
Range Energy Strategies, 2 vols., USCPO. 

(70) = [Fischer et al. 1976) 

Sérensen, B. (1976: "Dependability of Wind Energy 

Generators with Short-Term Energy Storage,” 

Science 194:935-937. 

[Office of Technology Assessment 19/78]. 
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ihe efficiency assumed tor the pond in these tables is 
probably too high by a tactor of about two, as cording 
to more recent results. The price should be about $11.5/ 


GJ ($67/bb1) (4. 1e/kWe-h), but would be up to a factor of 
three higher if salt had to be trucked to the site. 





Tor a more “microscopic” analvsis that takes account of the complexities of 
yvstem integration. Several recent studies, for example, have examined the 


$ of adding dispersed renewabDl2 sources [9 2 


snrealistic assumptions (notably that central power stations are far cheaper 


than they are at the margin, and that electricity demand will noc decreas 


- 
response to rising real costs), this conservatism makes the favorable findins 


Us 
w 


all the more interesting. The analvses [Svscems Control 1980,1980a,1980b. 
1980c; Boardman et al. 1981] find, for example, that dispersed renewable sour- 
ectricity, even if intermittent, would improve the svstem's generation 
re@liabdilicy (1980:5-52], and may add to service reliability by protecting the 
end-user against both grid and generation failures (:5-53]. Wind turbines 
.$tudied only as DOE designs, 200 kW-2.5 MW), photovoltaics, diesels, and fuel 
cells “can provide an economic alternative to large-scale central generation 
assumed to cost much less than actua! marginal cost] if their projected cost 
zoals can be met." (1960:Summ:3) (Those goals have already been exceeded dy 
small wind machines ‘Lovins 1973], and are lixelv to be met ahead of schedule, 
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as noted delow, for photevol Roughly half the distributed sources’ eco- 
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Nomic advantage comes from their capacity savings [Diesendorf i981], half from 
he total cost savings is not verv sensitive to the 


load or generation mix, Dut declines as the renewable 
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economic responses which would reduce total demand 
and cnange the shape of the grid [Diesendorf 1981] are assumed not to operate). 
Spreading the rerewadles, e.g. wind machines, over a larger zeographic 
region, or integrating different sources, e.g. wind with photovoltaics, im 
Sroves their reliability ane economics [System Control 1980:3-4; Diesendorf 


Yearetorvear variations in solar and wind energy are ‘less 
than tne variation in water flow of nanv Avdroelectric projects" and can de 
nandled Sy similar planning methods. Dispersed sources, if reliable, can save 


transmission and distribution costs and losses (amounting to about a tenth of 





tne generation savings) (id.:3-4]. Although analysis of renewable svstems with 
=< 

“A recent calcu.ation (Lee & Yamavee 1980) suggests that under pessimistic 
assumMOCions, extra sOinnine reserve requirements Mav imict tne economic use Of 
some renewasles t5 a few sercent of the total load (Svstems Control 1930). 
Sut since the assumed methodology appears t2 treat renewable and nonrenewadie 
generation asvmmetricalilv .the latter should a'so incur such a penaitv, espec- 

ailv since it can fail in much larger Slockxs) and to use unrealistic cost 

and outage cata for nonrenewable sources, &518 conclusion cannot Se considered 
re.iable. Aiso, | «kW of svstem storage “can orovide up ts 2 «Ww of spinnina- 
reserve and loade-fsiiowing capadilitv” (Systems Control 129SVUc:l<], sotentiat 
oroviding a cheaper s0.4t1°*F Svstems contro. is checking this furtsrer. 
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ispersed storage is complex, system economics do not seem very sensitive to 
- 


i) 


whether or where storage is provided, and photovoltaics in particul 


3 
guire on-site storage for favorable economics [Svstems Contro! 1980c] as some 
critics have claimed. 

Such detailed assessments offer useful insights into svstem desizn. 3ut 
cheir complexity and opacity may obscure che broader relationship detween the 
marginal prices of energy services from soft and hard technologies. The tables 
on the following three pages seek to illuminate that relationship in each of 
four service categories--low- and high-temperature heat, vehicular liquid 
Tuels, and electricity--by assembling a list of documented price calculations 
for a wide variety of sources. All prices are normalized to the same units 
(constant 1980 dollars per million BTU or, approximately, per zgigajoule) and to 
the same fixed charge rate (10%/y in real terms, or about 20¢%/y in nominal or 
current-dollar terms). Although no such comparison can be definitive, that 
provided here is designed to show the main components that determine price-- 
like the tables on pp. 230-231 [Lovins 1978] but using more up-to-date data. 

The firse table, for example, shows that low-temperature heat provided by 
Surning todav's fuels in a 70%-efficient furnace (better than most) will cost, 
with the very temporary exception of natural gas pending its decontrol, around 
$15/10° 3TU, or about twice as much as [subsidized] average 1980 electri- 
citv used in an extremely efficient heat pump. Synthetic gas from coal is 


tter; marginal electricity is about the same or worse--$25/10° 3TU in 


3 
Oo 
uv 
wo 


resistance heaters, $10 with the same super-efficient heat pump. In contrast, 
efficiency improvements cost tvpicallv $0-3/10% BTU saved (maximum $5 among 
che measures shown, which should keep the nation well occupied for the next 
decade or two). Passive solar measures are similarly cheap. With careful 
shopping, active solar heat, even on a single-house scale, is in the $8-10/ 
10° 3TU range, competing with deregulated fuels and power todav. The real 
orice of conventional packaged active svstems is widely expected to continue 
falling bv 2-34%/v [SERI 1981:11:175], and some simplified designs shown, 
whether do-it-vourself or commercial, have alreadv dropped prices even faster, 


-* 


empirically achieving about $4-6/10°9 3TU even with commercial fabrication. 


she empirical cost ($9) of heat from a municipally operated solar pond in Ohio 
a technology descrised Selow) also competes with oil or electriceresistance 
neat at today's prices, and sompetes even with electric or gas Seat pumps at 
marginal ori-ces. sommunicv solar heating svstems Gleason 1931,198la; Tavior & 
Tavlor 1981], using conventional collectors or solar ponss, can drop heat 











ces (1980 $) for energy in various final forms, 
97m l1Uesv real fixed charze rate. 
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'* ra anmte- : 77” = od - . ° ’ ’ ee 
Hear <100°C (<212°F) (35% of U.S. delivered enerzv needs) (excludes tax credits 
~ 





10/80 pre-decontrol gas\ subsidized fuel & power [SERI 1981:11:96! 4.0 

#2 neg. oil 3 $1.10/gal prices for comparison; (Green 1980! 13.7 

propane ¢ 80¢/zal 702-eff. free furnace .Green 1980! 13.4 

el. ¢ 5.5¢/kwWeh free resistance heaters 16.1 

el. 2 5.5¢/kwWeh $250/kWe .50%-efficient 6.3 
h 


ou 


at pump, i% O&™ 


marginal syngas (Lurgi 70%-eff. free furnace [Congr.Res.Serv. 15 
methanation 2 $36/bdbd1 $300/xWt input, 1304- 1981; TSD from 9. 
oil price & 50% equity) efficient heat pump Am.Gas Assn. 1977 

[Ross & Williams 1981: with GNP deflator! 
306], 2% O&M 











marginal! nuclear elec- free resistance heaters see el. table below 24.7 
tricity 8 3.4¢/kwWeh el. heat pump as above _—™ 7 " 10.3 
thermal retrofits: 34/v real discount rate, [SERI 1981:I1] 
direct-fueled houses lO-y time horizon 
saving »50% of neat [:12-13] Oe 
saving >75% of heat " 5.0 
el.oned. houses saving >50% of heat " 5.0 
commercial dildgs. Saving >35% 3-2 
New nouses saving >90% Leger, Phelps, etc. [Leger & Duce 1 ; . 
(see text pp. 183-4) Shick,Shurcliff 1980] 
residential solar retrofit [SERI 1981:11:946,204-5] 
.assive "best buys” " 1.$-2.2 
“average” (DIY & Solar I) . 3.57.8 
active "best buys” " 8.2 
“average” (DIY & Solar I) ” Psa 
1980 tvpical commercial no tax credit [:186-7} 9.4-32.5 
packaged solar water ht. +0% tax credit " >.6-20 .4 
1990 ditto, expected no tax credit (2186-7, 175] $ .0-25 .5 
13990 expected gas & 01! 75%-eff. furnace, low orices [{:137] 12.9-25.1 
ca.1982 Teagan solar w.n. simple design (Popular S$ci.198la] ca. 6-7 
i980 >breadoox water ht. batch; lO-v lifetime Green 19580; see 2.079.2 
also Shapiro 1980! 
1978 site-assembled act- [see also SERI 1981: [id.; Worcester 4.1l-11.4 
ive-solar air svstem 11:172; Godolphin 1981] Poly. 1978] 
1990-2900 lLowecost-col- average installed h.w. (3177) 5.3 
lector program goals svstem 
inflatadle greenhouse lOe-v horizon, S3¢/kwWeh far (Solar Flashes 1989; ca.0.5 
J006 370<9 r4 20 MMBTU/cord, 30: eff Greer 198 /.Q29 
solar son¢e (Miamisburz, beerved cost Soft En. Notes 9.6 
nid mur peration sare , 1 were Siz2zer ala Ls- 2) 2954 = 
mmmuritv solar svstems clat@olate senurr et al. 3407°9.4 
concentrator 1979:Ch.t7; ? 
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technology remarks reference $/10°S8TU 

‘ante -— w - =<. - . . . . 2 © *. A 4 
meat 2100 C (23. of U.S. delivered energy needs) (all tax credits exciucec 
2xceot suDdsicies [9 Onrenewsdile sources). 








marginal 21. (3.4¢ «kWen) free resistance heaters see el. table Sdelow Le 
$40/5d1 residual orl Weerredssctens free doiler, Bue 
svngas as adove ‘iL 2% 06M 12.0 
Manure Diogas | $00 £23 active vol. STA 1981:99] 7.8 
gas from $30/odt wood 304/¥v nominal fixed OTA 1980:11:138! 3.4°3.7 
.retrofic gasifier) | charge rate 
same, $20/oven drv ton different assumptions (SERI 1979:1:29] 3.3 
30'dia. parabolic dish Doug Wood (Fox Is. WA) (Soft En.Notes 2.2 
(new materials cost) (av.US cond’ns 50% better) 2:97 
s 





. ‘* “ ° . ° ° . 
, i180 W/m insolation, Grimmer 


300 C winston, 44% eff. 
incl. storage (50¢/c¢J) 3190/m? insc'd, 2208™ 1977} 
1980 handmade troughs, $45/fr2, 60% eff. 'SERI 1981:11:623, 
incl. storage ($1/GJ) in New Mexico, New Hampshire 630] 6.4-12.5 


¢ 
mass-prod'n zoals conservative (same range) 
expected " " 7 3.279 .6 
Optimistic " " " 2.3-3.8 





Sandia 1985 projection (315°C (<600°F) (En. Insider ‘30a] 10.0 
mass-droduced Fresnels, 130 w/me insolation, (Ross & Williams 3.6=-4.5 
$25-57/m-, 634 eff., install’n & plumbing 1981:33i; OTA 1978] 
incl. storage ($1/GJ) 360/m-, 2% O&M 


Vehicular liquid fuels (34% of U.S. delivered enerzv needs (all tax credits ex- 
—T? 


cluded except subsidies to nonrenewabdles; all STUs counted as equal in value, 
which underestimates fuel alcohois' value in appropri.te DdDlends or engines). 











1930 taxed reg. gasoline $1.35/U.S.gal. l 
’ 





svnftuei \EDS process, $4/5bd1 refining, mar- Congr.Res.Serv.1981] 
$36/5b1l o11, 50% equity) keting, & distribution 
svmfuel (He-coal, ditto) almost certainly too ,aid. 10.9 
svnfuel (Sasol II, ditto) low am estimate) ‘Td. 22.7 
a 
»2aAr = tae é3 4 - - 4 wahiea . ° 124.47 2 ¢ 
Zasoline saving efficien oad vehicles see text op an : 
"~~ ak auc sae ee be ’ 6ecsa? oe acahica ? Tae ; a7 ) ] Ye! 
ab.e2 ovroivzes ree, halfe-wet sawdust (Tatom et ai. 1979; 1.0°1.4 
methano!l from muni. wastes Green 1980, 3.9-8.1 
ovrolysis “sil” from (_Benemann 1977) 6.0 
Municipal wastes 
Nomemade ethanol mo crop or labor cost Amer. Homegrown Fuel! >./7 
Svroivsis “oil” from ‘Green 1980!) 5.9-12.6 
g00d & cellulosic wastes 
etharol from same enzymatic oroscess _Pve & Humphr a.l0-11 
2 $11.25, ode estimated from ‘abd. 19°9, 
methano. from Canadian ivdrid processes \IncerGroup 19°76, <ca.ldel3 
forestry wastes 
ethanol from zrains sonvent’l lzeseale d¢:et'n (OTA 19860:12:195) 11.3¢15.7 
sitto si:sce SERI 1980a:845' 15.8 
ethanol from cellulosics. ditto, sroaiected ,OTA 1980: 22:173) 12.2217.90 
mechan from 31930, odt id. 1d i) ..3°22.8 
ZO0C¢G x zen-gasif ac —— 
ethanol from anoceliiulose Emert process, srotected (SERI 1981:11:56 2.1% 
Sher 3F5¢C246688¢s — deve oment ma eld ea. 219 
methanol from a sources 308° Sot d SERI 1981:21:591!) §$.7-22.8 





























Illustrative delivered orices (1980 $) fcr energy in various finai forms, 
asswoing a snifors 10.,v real fixed charge rate 
technology remarks reference $/10°S3TU 
Electricity (3% of U.S. delivered energy needs)(excludes all tax credits except 
$udSicles [oO nonmrenewad es). 
1980 av.price (5.5¢/aW-hn) subsidized (Lovins 198la 16.1 
NYC taxed av. price (15.3¢) (peak rate 2+.9¢) Russell i961 -~.5 
Marginal price from subsidized; GNP deflator [id.; Bowring 1980) 24.9 
. de aaah ; . _ ee «aca 

LaR commissioned 1988 applied to earlier cal- \wovins 1977 ,19,Sa, 

3 .4¢/ kW-h) culation (at 12%/y real  1979a] 

fixed charge rate) 

same, recalculated (7.6 updated data on reactor, (KXomanoff 1981) 22.2> 
s/ke-h with 1979 reactor decommissioning, fuel- 10%/v real fixed ra 
ordering or ca. 3.6¢ cycle, and O&M costs; charge rate throughout 
with 1981 ordering) updated grid & fuel-cv- (|Sechtel data: Lovins 

using same sethodologv cle-facilityw costs; GN? 1979a:an20,21) 

Lovins 1977,197S8a,1979a! deflator used 1979-80. 
electricity savings typically 0-1 .S¢/kWen [Appendix A; SERI }-4.4 

see text, pp. 135,188 1981) 

microhydro (2-8¢/ «-h) highly site-specific ([SERI 1981:11:958) $.9-2 


nomemade solar-thernai- 
electric (30° dish) 

\Mew materials cost only) 
nighetech solar-thernal- 


(power tower) 
ed 
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Sommunity photovoltaic 
cogeneration system, 


i’ sfisa .ceueil. ~wrned 


-oumte ing “eat crecit 
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238 
Nandily with the marginal delivered price from newly ordered central power sta- 
Many of the presently available renewaples also compete with 
cae present average (:olled-in) price seen dy the consumer, or with the roughly 
2quivalent fuel and operating cost of running oil-fired stations (5-7+¢). Vir- 
my of the renewables would be attractive today in high-price areas, 
sucn as New York City (15¢ regular taxed price and 25¢ at peak periods in iate 
380), Alaskan villages and remote military bases (typically upwards of 40¢/kw- 
n), and rural areas of developing countries (30-90¢/kW-h). The table shows 
tnat tne smaller technologies tend to deliver cheaper electricity than the cen- 
tralized ones ‘Chapter 5), and illustrates the diversity of options. Photovol- 
taic prices, as noted below, are dropping so quickly that DOE now expects then, 
even in central-station applications, to compete with average grid prices by 
13986 using demonstrated technologies [Adler 1981; Maycock 1981; Russell 1981]; 


Dut microhydro and wind, and perhaps other renewable sources, have already 





achieved this with hardware now on the market. The same cannot be said of the 
centralized solar-electric systems——multi-megawatt wind machines, power towers, 
ocean-thermal-electric conversion, centralized biomass plantations to fuel ther- 
mal power plants, solar satellites, etc.--to which mich of the Federal solar 


Dudget nas Deen devoted for the past decade. There is not even a credible pros- 


ry, 


spect of ever achieving such competitiveness via the fusion program, the 
second-bizgest component of DOE's R&D budget (with about half as mich FY1982 


funding as fission and twice as mich as all renewables conbined). 


.3.2. Selected technical developments. 


The state of the art in inherently resilient energy sources has Deen treated in 


ature for lay audiences [Energy & Defense Projece 1980), 
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for scientists [Sorensen 1979; Lovins 1978], and for policy-makers (SER! 





i396 Soft inergy Notes]. It ts not possible in a document of this length to 
do justice to those fundamentals. Rather, in this section we shall highlight 
some recent technological advances which seem especially promising for making 


ne U.S. enerzy system less vulnerable and which have not been described in 


deat. Passive solar techniques are now known to be the Dest duy (after, 





ang iN combination witn, etriciency improvements, tor d0tCn new Sulicings and 


avallaD.2. One can now accurately simulate and optimize the performance of any 


som rnation of passive elements in any climate on a stancard hand calculator 
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Mational and international passive-solar conferences have 


refined and opagated th techniques with remarkable speed. Successful - 
retined and propagated these technique a bd | peed ccessful pas 
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New materials with very unusual properties are becoming available for both 
24ssive and active solar use. For example, an adhesive selective surface sel- 


, (ie 9 [= . . - = -_ . 
-1.9/ft- (SunSponge®) boosts the performance of Trombe walls 
glazed solar-aDsorbding masonry walls) by about a third, but costs less than 


the equivalent level of movable insulation (ca. 2-9 to R-12). Transparent in- 


uv 


sLating and heat-reflecting materials (including Heat Mirror®) are now in 
commercial production. Some new plastic-film glazing materials, such as 3M's 
Flexigard®, transmit better than window glass at visible wavelengths, are near- 
ly Opaque in the infrared, and show no signs of degradation after 12 years' 
weathering in bright sunlight [King 1979]. Tough, highly durable plastic films 
nave deen proposed dy T.3. Tavlor and developed bv Brookhaven National Labora- 
tory as materials for active solar collectors at least ten times cheaper than 
conventional ones. Such collectors have for several vears been sold in Swit- 
zerland [Ener-Nat 1979], and could easily be site-assembled just as plastic- 
film greenhouses are now. Stockpiling appropriate films and instructions could 
indeed be an important element of any solar mobilization. 

So diverse are solar collector designs that it is not yet clear whether 
flat-plate or concentrating collectors are superior for low-temperature appli- 
cations. OTA [1978] found that the cheapest collector on the 1977 market 


lastic mats and other unconventional designs, some of 
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wnich are quite effective) was a concentrating parabolic trough. Very simple 
automatic tracking mechanisms have been developed. They can be quite reliable, 


as attested dy the performance of military and airport radar trackers. Robert 
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thousands of sets of plans for a homemade con- 
sentrator of the type used on his own house, argues with some justification 
that even in a climate as cloudy as Boston, the extra efficiency of a concen- 
trating collector when exposed to direct sunlight can more than make up for its 


imadilitv to capture the diffuse light which a flat plate can, since much of 


tne diffuse light arrives at too low an intensitv to reach the operating thres- 


y.d of a conventional flart-plate collector. This argument has particular 
meric for shotovoltaic generation svstems (delow) 
A counterarzgument, however, is that in a cloudy climate, “conventional” 
flat plates--those witn a flat-bdiack adsorbing surface-ware the wrong choice 
4 “selective” surface . mn adsords visible wavelengths we. Sut radiates 
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vity ratio (visible aDsorptivity =: 
infrared emissivity) of abouc 5 can de obtained simpiv Dv Drushing a Lampbdlack- 
water siurry on a metal absorber plate and lercting it dry to a thickness which 
removes che metallic Luster Dut is still gray, aot dlack. A selectivity of ca. 
3-10 can de achieved dy many kinds of electrochemical coating processes and some 
special paints. Alternatively, for $3/m¢, a selectivity-3 foil can be an- 

plied, e.g. Dy stretching it over a slightly convex collector. Tais simple mod- 
ification produces remarkable results [Raetz 1979,1979a]. Because che diffusely 


Scattered iignt on a cloudy day, although somewhat reduced in intensity, i 


Ww 


ill energy of extremely high quaiity--its effective color temperature is over 
5000°F--a selective surface, suitably insulated, will attain very nigh equilib- 
rium temperatures. Thus Raetz's selectivity-8 single-glazed collector heats 
domestic water dy a highly satisfactory 56 F with 45% efficiency on a cloudy 
winter day in Hamburg (total insolation 200 W/m, or ome-fifth of the full 
summer-sunilizght level). (Insolation of 300 W/m2 raises the efficiency to 
57%.) Higher selectivity makes the collector even less sensitive to cloudiness. 
A selectivity in excess of 50 can de obtained by sputtering thin films, using 
well-establisned hizgh-vacuum techniques similar to but less demanding than those 
ssed in coating optical lenses. A selectivity-50 surface in a hard vacuum wiil 
serve a process neat Load at 500-600°C (ca. 930-1110°F) om a cloudy winter day 
in Jumeau. If the Liquid-metal coolant in such an absorber should stop flowing, 
tne metal absorber plate would melt. 

In contrast, only direct sunlight can be used to operate conventional con- 
centrating dishes, such as the 23'-diameter General Electric prototypes which 


F (450°C) at 71% efficiency [Sunworld 1980]. (That tem- 





erature 1s adequate to supply essentially all process heat needs in the food, 


- 


paper, and chemical industry, plus most of the needs of oil refining.) Point- 
F are beginning to enter the market. 
,000, 80-m2, 59-kWtp, 74-79%-ef- 
lent dish with calculated Northeast payback times of 3-10 y against oil 
Barden 1981], similar to the "conservative" SERI mass-production goal on p. 
235. Another dish has heated gas to 2200°F (1204°C) steadily, and to 2600°F 


1427°C) maximum [Solar Thermal Report !198la]. Commercial Line-focus systems, 





a eer 1AN Any E : ) 7 : Q a * . S00 
co wnich over 100,000 m= were made in the U.S. in 1980, go up to ca. 500 


- a m~omr+ey 2 e929 -~ © 1 _ " =f >» it > 2 + . 4 darwa:e 
sentra. receivers witn tftieitdads of tracking mirrors NneLlirostats) are under ceve. 
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Various Kinds of salts can be used--and preferably with a darkened Dotton. 
Botn direce and diffuse solar radiation heat up the dDofttom of the pond, but 


Decause tne nolCter water there dissolves mre sal 
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tive neat Cranster to the surface is suppressed. (with some zeometries, the 
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can also torm a self-stabilizing gradient of optical dending power which 
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tresh water on top, 
wnicn stays fairly well segregated, acts as a transparent insulator. Other 
forms of translucent insulation can also be added. A simple heat exchaager, 
es near the dDottom, can extract heat at nearly the boiling 
onds in sunny areas can boil dv late summer. The large thermal 
mass of the pond provides Duilt-in heat storage, although it may take some 
months to come up to its full working temperature. Good ponds are 20-30% 
efficient in converting total insolation to heat. They may cost $5-10/m2 
it is available on-site, as near many mines and factories; $30 m2 or 


more if the hole, Liner, and salt must de specially provided. 


9f MiamisdDurg, Ohio 


surface, the botton 


' 
am 
2, 
. 
rv 
a 
~~ 
> 
ae 
3 
=) 
rv 
J 
m 


dispelied that notion. 
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id spell of February 1978 was still 83 F (28 C). Total 
cost, mostly salt (1100 tons) and liner, was $34.4/m*, maintenance cost is 


very small, and the delivered heat price, as noted on p. 234, is $9.2/10° 
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merable heat source: even an event which disturbed the salt zradient and re- 





duced Llection 2fficiency would still leave weeks’ worth of recoverable heat 
Similar. ice nds {McPhee 198la] provide full seasonal storage of cooith, 
flering Te.iad.2e a.rrconditioning at a tentn of the sual 2nerz $ 
enicui ar 2h =nougzn 314 els an Se sustainadi sroduced from 
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| cne successful operation of a <UYUUU-m= pond dy the City 








242 
1981). ne main tvpes ar2 pvroiysis “oil” mace dv heating woody sudstances 
with lictle air; such “oil” slurried with char produced in the same process; 
methanol; etnanol; dutano and Silends of various alcohols. Gasohol? is a 
Dlend of 10. anhydrous ethanol witn 90% gasoline.) Some of these fuels are 


©OSsts upd °O severa. Runcred collars tor retrorit or notcning at tne tactorv. act 
+ ’ 4 = = - = - - ? = — ; = 

POULS DE Ne.diu. for prepareagness if, tor examMpie, car Makers usec metrhanol- 
Sroor components in fu systems anc provicec carduretors ailin 2 switecn tor 


2asv conversion Between gasoline, zgasoline/aicohol blends, and pure aiconol. 
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a 
adle ,SERI 1980,1980a!, though so far similar material is not available for 
2ther, more promising, feedstocks, processes, an? products. Extensive grass- 


ed Sv a wide range of groups, especially in the Midwest ,|Znerzv Consumer 1980). 
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Given that «nowledge, a still big enough to run a car can be Dduilt from common- 
lv availadle materials in a few davs and operated from almost anv sugary or 
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Although not energv-efficient, it does provide a premium 


2therwise de waste materials. Small- and medium-sized eth- 
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anol plants offer interesting advantages for integration into farm operations 
Patterson 1.980) and are attracting special interest as a community economic 
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ev 1980,. Whether ethanol 
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ts produced in small stills or (preferabiv) a wider range of fuels is produced 


iallv cellulosic 
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wastes), the sotertial contridution, both routine and emergency, from many 


sma... plants could be very larze. As an analogy, in the U.S. about 11 maiilion 
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Many people taink only of corn-dased ethanol when Diomass liquids are men- 
Ciomec. In fact, this its far trom the onlv important feedstock, process, or 
procuct, and--especialiv with the inefficienc, oil- or gas-fired stills common- 
.v used-"-1s among the least attractive. Otner processes, notadiv thermochemi- 
[2. 3Mes, Nave Setter economics and at least equal rzechnical simplicity. Jonn 
Tatom 207s Ridge Rd., Smvrna GA 30080!) nas desizned effective pyrolvzers for 
Seveloping countries, made of old o11 drums, rocxs, and pieces of pipe.) Feed- 
Stocks aD>0und, even in urdan areas: just the pure, separated tree materia. sent 


es County landfills, not counting mixed truck 


00-3000 tons with an energy content of the order of 1 Gat. At a nominal con- 
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cruel yield--equivalent to the energy content of nearly half a million gallons 
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>f gasoline per day--would suffice to drive a S0-mpg car more than ten miles 


Der sav for every household in the County. The cotton-gin trash in Texas is 
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present efficiencies. The distressed 
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grain in NeoOraska would fuel a tenth of the cars in Nebraska at 50 apg, and at 


< same efficiency the straw burned in the fields of France or Denmark each 


and rice straw in California to peach-p:ts in Georgia and apple pumice (left 


tized terms 
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alter squeezing cider) in Pennsylvania. But numerous small, 
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cohol, are now typically 0.46-0.48--90-95 
the theoretical limit--for glucose fermentation to ethanol. These processes 


,'* - 


are ilkely to Decome widely available ar all scales of operation ower the next 
he third and technically most exciting line of development is the evolu- 
lon 2f new orocesses (or refinement of old ones--acid hydrolysis has deen in 
sse for over a centurv) to convert cellulosic wastes, the most versarile and 
adDundant «ind, into alcohols. Acid hvdro!vsis can Dreax down cellulose to 


? 
' 


Zlucose with virtually complete vields [Ladisch ec al. 1978], providing a yield 





2f over 0.4 from cellulose to ethanol [Ferchack & Pve 198la; SERI 1981]. Ther- 


mochemical processes can vield methanol by the routine catalvtic "shift reac- 


cion” [SERI 1981:11:583ff] of synthesis gas (a hydrogen/carbon-monoxide mixture 
produced by oxvgen gasification of Diomass) with steam. Using modified coal- 
conversion technology, which is not optimal for biomass, the yield of the whole 
Drocess is about 9.40-0.48 [OTA 1980]. A new downdraft gasifier has increased 
the methanol vield to an astonishing 0.83 [SERI 1981:11:585]. Pyrolytic “oil” 
oroduction yields at least 0.5 [Lindserm 1979], and typically 0.6-0.8 
including the slurried char, even in small plants that can fit om the back of a 


Dickup truck [Tatom et al. 1976]. Methanol has long been used as a racing-car 


rue. for its high performance, cleanliness, and safetv; in a high-compression- 
ratio car (sav, 14:1 or more), it can readily supply only 20-25% fewer mpg than 
zasoline, even thougn its energy content per gallon is only half as great. 
Methanol ethanol tert-dutanol Slends and other combinations can be even more 
advantageous [Tom Reed, SERI, sers. commun. 1980]. Since cellulosic feedstocks 
are the most widespread and the easiest to convert and use efficiently in 
sma.i, aispersed plants using low technology, the emerging cellulosic conver- 
$1OM processes seem particularly advantageous for Suilding a nearly invulner- 
adie national capability for dispersed, sustainadle liquid fuel production. 

oad vehicles can be run on other than liquid fueis. Canada nas a program 
>f conversion to compressed natural zas (a method already used Sy some fobdv- 


cs) and to LPG*, A million portable wood gasifiers (5. 149) ran European cars 





juring World War II. Extensive data are available | Ingenidrsvetenskapsakada- 
mien 1950) on their design and serfornance. Although thev take adout an hour a 
Sav to fuel and care for, and consume 22 1b of drv wood ser gallon gasoiine 
>Quiva.ent, &*rev are such a robust substitute in heavily wooded regions that 
Sweden 16 considering stockoiling gasifiers in case of severe gasoline short- 
2z@ ther alternatives ar® conceivadie: heat engines Sased on liquic air nav 
Se interesting, and electric cars, trough uncompetitive in principle with effice 

ent s@.@G cars, Bight secome ad.2@ @1th very @ap onecar pnotovoitaics 
raAdout 3 million sarSuretors nave Seen gold in ~ 5. since i969 





Siectricitv. The most commonly discussed renewable electrical sources are 





vy, wind electricity, and photovoltaics (sciar cells). Wind 
anc micronvcr> can also be used for pumping water or heat, for compressing 
storaDl2 air to run machines, or even for refrigeration [Franklin 1980]. 
le-known option may, in favorable sites, de the cheapest known 

se Of new Saseload electricity: a solar pond with a low-temperature (e.2. 
Ranaine) heat engine, especially if it works into an ice pond as suggested dv 
1.5. Taylor. Israel has operated a 150-kwe solar pond/Rankine engine since 
1979; plans 5 Mee at ca. $2000/kWe in 1983; plans 2 Gwe in floating solar ponds 
in tne Dead sea dv 2000; and projects 4-7¢e/kw-hn for a proposed Southern Cali- 
fornia Edison Co. plan (officially projected at 7-l0¢€) in the Salton Sea. 

Small hydro--variously defined as less than 5-25 MWe or less than 100 kWe 
per site--is being intensively exploited by entrepreneurs [McPhee 1981]. All 
Sut forgotten until 1976-77 [Congressional Researcn Service 197§:48-128], in- 
MumeradDle small dams, including over ten thousand in New England alone, had 
Deen adandoned. (Many existing large dams were also left with empty turdine 
Davs: id.:129-136].) The National Hydroelectric Power Study Dy the Army Corps 


af Engineers, gue to Se completed in autumn 1981, is reportedly identifying 
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Some sites are environmentally or institutionally 
snsuitable (Franklin Pierce Energy Law Center], but many others can be refur- 


Jisnea (and some developed from 


ws 


cratcn) using straightforward and cost-eftfe- 
ctave technologies (Energy & Defense Project 1980:178-86] for which a do-it- 


rs) 
yourself manual is available {|Alward et al. 1979]. Run-of-the-river sites an 





. 


neads as low as 5° can be used (Schneider Corp. 1980). 
ress is hard to measure Secause many utilities seem to 


4 
ir nydro projects: e.g., Pacific Gas & Electric and Southern Cal- 


v 


Lifornia Edison reported 179 MWe of hydro in the January 1981 Electrical World 





Survey of capacity additions underway, but the California Energy Commission's 


start report on the proposed Allen-warner Valiev coal project iists, ‘for these 
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-wO companies respectively, °27 and 1150 MWe as reasonadDly expected to occur 
a 4 4 ee t " vr : " "” ? a ] 
anc ca. .oUU anc OU Mee a8 acGditional, Sut not counted. ihus projects alrea- 
- 4 . ° e 7 ~~ > 2 -,} . tt; af 
iy underwav, most of them with FERC permits filed for, total 155/ Mwe--over ten 
times what the Ew survey reflects (Jim Harding, pers.comm., 19 Mav i961]. A 
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w - ~ —- -_—_—-”* - - = i--a = 7 > = ~~“? . - we. oo: 
f:cromycro should de speeded Sv new companies providing 3; o-hassie” curnkey 
sevelopment service and Dy che imminent entry into the U.S. market of cheap 
“ms mae al om © = a 4 . = _— > = - -~ - 
~nimese turdines (designed Dy American engineers a half-century azo). China, 

fd > > } > ~ ~< - ~ ~yy 
aS mentioned on Sp. +950, now claims to zet over 3.4 Gwe from over 90,900 

ye 2 S-> al ~*~ - 2 ~~ > ~~ _—-*. “7s ~ww 


~oCa. micronmydro sets (few of them grid-connected jEnerzy & Defense Pro 


i950:1/5,) ranging crom 0.6 cc 100 kWe, usually with 0-5 m heads. This adds up 
[3 at Least cwor-thirds of all Chinese electricity outside the cities ,Lovins 
i9/sDi ser ,., anc powers over half of che dispersed light industry--an importans: 


@indpower has the disadvantage (compared to flat-plare photovoitaics) of 
moving parts, Sut che considerable advantage of high power censity. A machine 
extracting 30% of the power in the wind--reasonable performance for a good 


design witnout fancy equipment (tipvanes, shrouds, variable pitch, etc. )--can 


ry 


extract 24 WwW per m >f swept area at an average windspeed of 4 m/s; 3! W at 


9 ms; 192 Wat 46 m/s |Sérensen 1979a:5!. In contrast, a lO%-efficient solar 
** _ - ° . _ =e 5 . . 
cell in average U.S. insolation extracts only 18 w/m*. Accordingly, a sim 


ple wind machine can capture mecnanical work at very low prices. Simple designs 


$3) homemade (est. $6700 commercial) 17.5-kwp (2 17 a/s) Chalk wheel of Otto 
are becoming availaDle. The Borre sailwing design 
is on the market as an 13-kWp model for aDout $650-690/kWp (1980 
Sarter 19°38), producing at about Se/kwWen (1980 $). U.S. Windpower machines 
Sased on commonly available components are selling (complete except tower, FOB 
factory, 1981) for $910-700/kWp in the 25 kW (model CA) and 37 «kW (CB) sizes 


Stoddard 1981), ane a refined prototype can be made for about half that mich 


id... A private entrepreneur, Terry Merkham, recently Suilt 2a i-Mwp machine 
> % 2 Pet , “~ + . _* “* * *“*e2 © “sf Pn | « ] > } \e) ~ $400 YL Tv 
for a Pennsylvania tactory at a cost (materials plus labor) of 3600/KWp. The 








more than <0 manufacturers of small machines are listed in periodic indices pud- 
.isned Sy wind Power Dizest, the American wind Energy Association, and the Rock- 
wel. international wind test srogram at Rocky Flats. Basic guides to seiecting 
aind macnines Para« 1951, and their sites |wegley et al. 19/5); are Dringing the 
technology into common currency New “wind prospecting” methods include satel- 

te wWserva lt. ¢ inversion SreakupD ', Of Alaska) and detailed computer 

TM. ati @.1cf.0OwW ec sigzitized terrain (Lawrence Livermore 
wSTZePsc 4.2 COMET IIa. BING Sfajects ar SOTLNg@ing ud. pQutnern an 52 OTN SA 

: . erating a 3- ira Bid ed machine 1ed 5 ar.les 
scnact.e 8s already contracted r we of wind capacit from entrepreneurs 
and is Negotiating for another 215 MWe a. chia expects <2 get ¢ its 
eL.eceracat fom wind in 1985 and } AN « a 290°Mwe windfarnm 30 smiles NE 

f san Fran : ; 6¢ - sit sring 759° 5%, . 5 ear ,aen a‘ 
3.3€/Karh fea and eingpower is current etal z 3 <a> 
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pest t2 fimancing’ 129 supply 9% of Hawaiian Zlecrric Comanv's electricicry Vv 
935 via 20 +-MW wind machines on Oahu. A private entrepreneur, Jay Carter, ha 
r2portediv Suilt 125 sailwing gyromills of 25-30 «wW each, Listing ac $13,000, 
-> Tum a Dleacn plant in Dalnart, Texas |Energv Research Reports 1979). 





2vOitalcs are extremely duradDle, reliale, and simple to use: when 
p-acesd in the sun, they produce direct current, needing no maintenance unless 
Nev Rave 42 Cracking concentrator. These qualities nave Long commended them 
cm applications as powering DSuovs, highway signs, Forest Service towers 
OWave relay stations, and remote military bases (part of the rationale for 
proposed DOD purchases [Congressional Research Service 1978:223-274]). As with 


sramsistors in the 1950s and 1960s and integrated circuits in the i970s, the 


wn 
mi 
~ 
*. 
v 

3 


sf conventional, first-generation cells (Czochralski silicon wafers) 
nas Deen falling dramatically, with array prices dropping from about $30/W 
976 to S$7-10/Wp in 1979-80. (Photovoltaics are rated in peak watts or wp 


9 ee , , 
ct-current output at 1 kW/m- insolation.) There is a consensus 
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the very competently run Federal program that implement- 
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oroducing such cells in a more automated fashion, 


ev 


tne J0-odd Anand operations now needed, can reduce the array price to 


orresponding to an installed whole-systenm 
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flat-plate svstems [JPL 1980; Smith 1981}. 
12 28 also highly Likely that several of the second-generation processes 


already demonstrated and in advanced commercial developmente-silicon wed or 


J 


riddDon growth, amorphous silicon films (which can De very cheaply vacuumrdepo- 


oo 


m amything, including plastic films), or other materials--will achieve, 
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voltaics Energy Advisory 


estimates for conventional sources maxe it 1 
voltaics will compet2 around 1986 (Ad 
cogeneration versions should compete around 


Starting several years ago on a community sc 


It will probably be fairiv common for new houses 


the late 1950s to be net exoorters of electr 


Notovoltaic shingles which cost about 
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ectricity too and are hooked up dv 


Instruments is developing a clever photovolt 


ing, as is the wav of semiconductors, tco qu 
extra sense of urgency into our findings abo 


Appendix A) and the need to plan for the 


. o “ a4 

integration into the sower azrid (op. 224-228 
. - 

tion is indeed already upon us (5p. 256) ae 


c the confidently expected 1986 
ghs, wili compete with grid elec- 
Accordingly, DOE’s Solar Photo- 


a 
9f rapid technical advances, PURPA dDuvback provisions, and higher mé@rzgina. cost 


tkely chat central-station photo- 


ale [Ross & Williams 1981!. 
and some old ones) 5v 
icity. General Electric is devel- 
the same as normal shingles but 
Texas 


mailing them onto the roof. 


aicmhvdpgen svstem with onsite av- 


Jevelopments in this field are mov- 


ickly even to report. This puts an 


at the risk of utiiityv bankruptcy 


ong-term shape of renewable source 


The photovoltaics revolu- 


had better start getting used to 


the idea and figuring out how best to use these rugged, almost invulneradle 


sevices to increase the resilience of nation 


in summary, then: the mnost up-to-date s 


al electrical supply. 


urvevs of the status of renewable 


sources find .e.2. SERI 1981) that cost-effective renewadle technologies now in 
Sr encering commerc: service are sufficient to meet at least most, and proo- 
adliv about all, enerzv needs of the United States within the Lifetime of power 
stations tow deing commissioned Im comjunction with even more costreffective 
, ; , 
efficiency improvemerts, these inherentiv resilient sources can profoundiv 
mprove rational security Sv making impossidile manv types of large-scale 
fal.cure of energy suppiv and manv of the sideweffects of failures in dangerous 
energy svstems These developments have so far received virtually no profes- 
siomal attention outside the relatively small number of energy specialists who 
ive eof up witrA caen et tare sffer arguably the greatest rational-security 
sportunity ain our lifetime 
* @ s 3 “Z aster 4 ° 4 re . er eoera* ae , te@eaaés 4 4 ger 2¢ 
tne chread © 24:8 ana.vgis if orter se erned with oreparedness 
and ces nce de Setter a512 to grasp this extraordinar mance to turn 
4 ofesent sanger C2) a4 tew source of security and prosperit 
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Jalilev in southern Colorado--a sunny but cold plateau ac sUQU elevation, 

? : 7 7? | 
Nearly 42s lLarze as Delaware. the traditionai dAlspanic community in tne Vai Vv 
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they could not afford to buy wood or any commercial fuel. 3ut a few people in 
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how to Dulld very cheap solar greenhouses out of scrounged 
materials, averaging under $200 each. Through hands-on greenhouse workshops, 
somewhat akin to old-fashioned barn-raisings, the word spread quickly. Ina 
few years, the Valley has gone from a documented four to over 800 greenhouses-- 
@nich noc only provide mosc or all of the space heating but also extend the 
growing season from three months to year-round, greatly improving families’ 
winter tutrition and cash-flow. There are solar trailers, a solar Post Office, 
even a solar mortuary. Baskin & Robbins has installed a high-technology solar 
system on its ice-cream parlor. Now other renewable sources are starting to 


spreac: wind machines are springing up, and some farmers are building an ethan- 
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potatoes and barley washings and powered Dy geothermal 
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orocess neat. The Valley is on its way to energy self-reliance Decause, under 
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9f a supply interruption, people found they were too poor to use 


Tools for such Local action are becoming widely available: two nationai 
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ity renewable enerzy systems ([|SERI 1980bd,198la], books of 
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Sas2e-studies [Center for Renewable Resources 1980; Ridgeway 1979}, how-to books 

2.2. Wilson 1981; Reif 1981; Morrison 1979], guides to county enerzy analysis 
enson & Okagaki 1979], indices to local resources [Department of Energy 

1250a}], technical compendia on renewable resource bases [Glidden & High 1980] 


and tecnnologies |Soft Energy Notes}, and introductions to community plannin 
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for resilience (|Corbece 1981]. Among the most valuable ways of putting tools 


in people's hands has been the free DOE periodical The Energy Consumer, whose 
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special issues--2n such sudjects as solar energy (1979;, alcohol fuels ({1960/, 


sommunity energy programs |1980a], and energy preparedness [1980bj--inciude 
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2nerzy efficiency and appropriate ewable supply (SERL 1960b,19¢ia] nave ied 
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é ° x _ a 2 a2 = A Po - 
a few tnougntful citizens to propose 2 concept of a locally dased efriciency= 
' 
and-renewabdles modiliza nt) increase rational energy oreparedness et 











aez:y 
i Be 
s™ rF- Sc 3 oy = - wa & > - = -a vT"? ' ~ > ; _ 
aMOng nese are -ran avaoster rormer girector Of iA S$ SOLAY programs and pre 
? > ~ J >| ~ i rr? ” a] - + ny ani" , - . . — ° > ° nf } Y 
aww De 2 ~rl uw AL Ver - -* c - rank. in Lounty =Rer2y bad rojecc j anc asec ~encins, 


atCernationa: solar Energy Society (AS/ISZS). 2getner they have organized 
generally uncer As/ISES auspices) several programs to explore voluntary "mobil- 


ion. This approach presupposes [Energy Consumer 1980b:13ffj that “energy 





ortages will not Se half so politicaily disruptive if communities see a 


cimetapDl2 and a supply of their own making,” and that mobilization should seek 
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Drevent shortages, not merely respond to them. 





concept recognizes not only the political erficiency of 
, but also the fact that in hundreds of commun- 
ities and several regions (including New Engiand and Southern New York State), 
assessments of local renewable resources have found "a gold mine of opportuni- 
> this end, Jenkins and Koster and their colleagues have proposed 
(2 AS/ISES an institute to speed the dissemination of tools for local energy 
modDilization; are working with several existing efforts to train local govern- 
ment officials; nave sougnt (so far unsuccessfully) DOE support for preparing a 


mod ilization nandbook" for widespread local distribution; and are hoping to 
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industry as a major constituency and actor for promoting local initia- 
Jenkins is also preparing a paper summarizing the mechanisms, incen- 
cives, and organizational patterns that seem most effective in promoting com 
munity @wareness and action to increase energy preparedness. 


he remarxadDle chord that these citizen actions have struck rests on the 


widespread perception, especially among municipal and county leaders, that if, 
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now. Our amalysis, Dased on meetings in hundreds of communities, has shown that 
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In a country as large and diverse as the United States, any issu 
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ederal trend towards devolving choice back to a state and local 

Level wisely recognizes that unique Local circumstances can often de dest dealt 

with dy people who know them in detail--provided the will to do so its there. 

in this spirit, existing state energy and emerzgency-pianning offices could play 
dness, and a few are already doing pioneering work 

wnhicn deserves careful consideration by Federal officials. 

California, for example, is widely regarded as the leader--perhaps just 
anead of oil-dependenc Hawai1i--in analyzing and preparing for interruptions of 
2il supply (and to a lesser extent of natural gas and electricity). This 
approach and expertise are in part an outgrowth of the high expectation of a 
major earthquake and of state experience in managing drought. The state's oul 
prospects nave deen analyzed at a sophisticated level 
1981]. The Energy Commission's Energy Contingency Planning Staff, led by Com 
missioner Varanini, nas summarized in a memorable 1981 wali-chart ("Oil Crisis 
Regulations") the Labyrinth of present arrangements--international, Federal, 
state, and Locai--for coping with an oil crisis, and has shown in a 1980-81 
series of well-argued papers and consequence models that those arrangements 
would be Largely unworkable even if executed with perfect competence. 


Energy Imerzgency Districts nave deen proposed [Energy & Defense Project 


1930] as a basis for an inventory and mbilization of local energy sources and 
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Kills, and for demonstrating local renewable sources’ potential for improving 
preparedness. The California effort, thougn generally supportive of the local 
“modDilization"™ concept and of other private initiatives, does not go nearly so 
tar. It is still largely directed towards managing shortages, not with the more 
tundamental snitts in strategy needed to make the probability and consequences 
shortages very small. Thus although the efforts of Varanini et al. are ar- 
Zguably the Dest of their kind at a state level, they are no subdstitute for the 
more comprenensive view of energy resilience proposed in this study. They can, 
however, help to provide a framework for political leadership to encourage and 
coordinate Local actions that would most quickly accomplish that shifc. Ile 1s 


tnerefor2 especially unfortunate that the same Federal Dudget cuS which criopled 


sudstitutes as the Energy Management Partnership Act (whicn was not enacted 
. : 2 - «A + - _ ; a . oR A 2 eo 
much of the present capadDility for coordinating state energy preparedness meas 
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Paper .cMR 195U:9),, [or example, states that 
-n@ reailtcies Jt Che emergv cuture inacicate tre wWisGoM Ji acce.eratec 
-iidrts CoO ceve.op new and renewable energy forms....ahile most conven- 
Tioma. torecasts imply a relatively modest role for renewables, it is 
clear tnat many Canadians do not share tnat view. indeed, the dramatic 
7 - i + Te : = > - j - 
surge in the use or .tuel wood. ..sugges that these forecas understate 
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suDstantiaily tne contribution to be made. Moreover, while 
ul tools for analysis, they can tell us only what will ha 

in conditions. The conditions- the policies--are che ke; 

tul and concerned Canadians believe that we should alte 
hat we should decide soon on a preferred energy future, and estad- 

he conditions that will cake us there. The National Energy Program 
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lish ct 

envisages a mich greater role for renewable energy. The Government of 

Canada dDelieves that economic realities now favour a range of renewable 
: al 


v.S. policy places greater ress on allowing 


‘? 


he renewable share to de deter- 


mined by the marketplace rather than dy social planning, and the previous Admin- 


° 
istration $s goal of 20% renewable supply by the year 2000 has deen formally 
‘ 


adandoned (current DOE estimates are under 10%--a2 share only a third larger 
than todav). Manv of the substantive embodiments of previous Dipartisan 


>ommitments to accelerating efficiency and renewable technologies have also 
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Deen ciluted or reversed. Nevertheless, the general tone is guardedly 


fost 'renewables'...have 1 
severe Long-term environme 
may De confined) to any sp 


tcle or no public opposition; aor do they pose 
tal problems. Thus, they are well suited (and 
cific regional markets where they make } 
sense. The Administration's clear and consistent adherence to fre 
orinciples will remove artificial barriers and provide a major imp 
the development of such technologie 
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In giving practical effect to such generalities, however, we recommend several 


to retlect in Federal energv think- 
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Co vulnerability and resilience which the fore- 
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ai zgrics ing witn traditional studies 89 technical relisilitv; and there are 
site- and orogram specific nuclear security analvses. Yet tne concerns of ail 
these prczrams 3re2 akin to, and somewhat narrower than, tnose raised in Chapter 
3. Trev do aot vet reflect this studv's dDroader approach to systematically 
aCNieving energy resilience. the rotential contriducion of end-use efriciency 
aN@ appropriat2? renewadle sources in enhancing AMationmal securitCyv~-~especial.v in 
Minimizing (ne consequences Of Cerrorist a€tacks--is thus noc deing properly 
exploited Secause it is not fullv perceived 
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sco, even its partner Exxon 
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ect, tnat was tCantamount to an 





“-che same approach Seing applied to efficiency and most renewadles, which can 
nold their own in fair competition Dut perhaps not against things iike sudsi- 
3izec 31. S$HAL2, -onven 

From a preparedness persvecftive it is regrettable that recent dDudget 
shifts nave tendec to maintain or increase support to the costliest, most vul- 


neradDle, and most heavily subsidized technologies while reducing support to tne 
cheapest, least vulnerable, and least heavily sudDsidized. Eliminating all the 
suMsidies would De Setter. Meanwhile, comensatory programs (such as the Con- 
servation and Solar Bank) to help the most vulnerable members of society 
acnieve energy self-reliance deserve support. So do cost-effective Federal 
Non-sudsidv orograms to speed the refinement and use of the most resilient 


es. A sampling of such opportunities--many already endorsed Sy DOE s 


rv 


1ciency programs, 


rv 


Energy Research Advisory B30ard--includes industrial e 
appliance efficiency Labelling and a wide range of other consumer information 
Drograms, ana.ysis of institutional Sarriers to least-cost investments, the 


’ “7 - . . - ~ -« .- » . _-~ , « . ‘ * 
implementation studies and programs of the Solar erzy Research Institute and 


mM 


determinants of enerzy use (EKA3 1981:6)), and R&D into second-generation photo- 
VOstaics. The Last of these is, Like vetrigerators, a prime example of a vast 
marxet likely £2 Se captured Dv Japan if U.S. industry concentrates mainiveras 
ig would tend to @o if not helsed to take a lonzer viewmron first-generation 
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third, in order to 
eVing energy resiiie 
Nsure the conditioas 
zZu.ation will indeed 
Siencv anc renewable 
lt in a frustraciag 
a.3. For example, v 
Liv Regulatory Polic 
tv oractices with a 
C2 encourage entrepr 
tne Federal Energy & 
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9f spontaneous ef £1 
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-Ometitive market im generation, 1s the dest single 
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al programs of dispersed electric generation. 
ory Commission, rather than encoura 

rates, is overlooking derisory rates and defend- 
egal and political attack Dy special interests 


. a : te . ime 
to competition. FERC is also rapidly increasin 
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rectively locking up money which, 1 
ce, would go to cheaper and more resilient alter- 
financial integrity (Appendix A). Like- 


nelp states and localities to modernize their 


information on cost-effective technologies, and other- 
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FEMA's preparedness % jectives. 


iciency-ralsing technologies are evolving extreme- 


and renewables programs will not De realized. 
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secisions cfaxen on other grounds. [ft would 4.s0 be worthwhile to itsprove 


~*? ~ - ~~ ° - = --* 7 = . 7 m4 
iteres= in energy resiiience (as in Senator Percy s study of a possidie 
wationa. yvetense A.cohol Fuel Reserve). currently, whether in the Executive or 


specialized, scattered, and 
sncoordinated. It is understandable that FEMA snould de somewhat preoccudiecd 
oy such complex and specific responsibilities such as nuclear evacuation plans 


anc post-attack planning. But someone--if not FEMA, then some other expert 


ta 


agencv--must Degin to consider the mich Droader canvas of planning for resili- 


ence wnich this study describes* 
in summary: our consideration of energy preparedness, and our experience 
#itn hundreds of local and regional energy efforts around the country, leacs us 
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fruitful roles for an agency like FEMA in promoting 


energy preparecness would De to raise the consciousness, expertise, and public 
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those Federal agencies whose decisions are increasing energy 
Vu.smeradDility, to identify and coordinate Federal action on those detailed gaps 


1 Federal planning which we have identified (such as grid integration); and to 
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EMA will appiy to many other areas of national vulnera- 
ne style of analysis we use nere. The production and distribution of 
food 1s an obvious case: supply lines are currently so iong that a truckers’ 
tes r Sad weather can put manv retail ‘food stores, especially in the East, 
ations in a matter of days. The reasons for this vulnerability are 
much the same (lormg supply Lines, tight coupiing, etc.) as those we identified 

~ stem in Chapter 2.1, and potential remedies are also Largely 
he promotion of greater self-re.iance in food production as de- 
ne country and Detween urdan and rural areas could cleariv 
maxe .Tportant contributions to national preparedness. in some instances, 
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$uCN 43 A.asSka, such essential self-reliance used ¢9 exist Sut was svstemati- 
gaily cismantled in che 1950s and 1960s in order *°o produce commercially re- 


supply line (in that case from Seattle). A few 
attle today would Sring Alaska near to starvation; 
et exporter of food, and holds many national rece 
ne Joint Committee on Defense Production (19 
found that simicar considerations apply to American industrv, whose 


laracterisics are tailor-made for easv disrustion. The Committee found that 


rrecting tnese defects, even at the margin and over many cgecaces, could Se 

ery costiy. But tne cost of not doing so could Se even Aizner--a rapid reo- 
_—_——_-- 

gression of tens Or even hundreds of years in the evolution of the American 
2c my, should it 3e sudgenlyv and gravely disrupted. A third area where it 
#@OU.S 32 imMortant CoO apoi a similar analysis is water dolicyrrcurrent.y if 
Che state of Looming crisis that energy was if iA the 1990s, and f9f striking 
‘ $imi.iar reasons anhetner dserceived or tot, the true implications of these 
and otner vuirteradi -1e@¢$ wh. NexoraDdD.v Se Sorne in uvon us 5 i surDtrise- 
Sisk. suture Ener2zy ooiie s only the first of san 7OLCes Setween resi.i- 
ence and collapse 
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i -tility cash-flow is inherenc!v unstabie [|2!. 

S.ectric utilities are extraordinarily capital-inrensive--about a hundred 
times as such as the traditional d:irect-fuel energy systems on which the 
American economv was Suile. Owing to the scale and complexity of the 
tecnnoiogies, construction lead times for traditional major utrlitv 
nyvestments are irreducibiv several times longer than the time constant 
Tor short-run price elasticity of demand. Accordingly, a ucility that 
Srsers a power plant will inevitably ovwerbuiid. Higher marginal costs 
require Aigner prices to maintain financial healt tion. 


a 

These higher prices dampen demand growth below the expected 
lant is commissioned, demand and n 

[2 cover fixed charges. This shortfall induce 


$s still higher prices, 
sampening demand zgrowth--or, in some cases, the level of demand--sc:11 


irther, thus increasing overcapacity and eroding cash-flow still more. 
semand at the time of plant completion falls persistently short o 
expectations, cash-flow will progressively collapse. 


So far into this “spiral of impossibility” are U.S. utilities that if 
plant construction project in the country were cancelled now, 
d for the rest of the century twice the rate of peak demand 

d in 1979 (a “normal” year with 3.2% real GNP growth), then 

.m 2000, we would still have nationally--ignoring significant regional 

si fferences--a prucent 15% reserve margin, just dv working off the fat. 

This does not count price-induced acceleration of improvements in elec- 

trical productivity, nor 200° Gwe of availabie cogeneration, nor other 

alternatives.) This overcapacity has built up through demand forecasts 

$9 exaggeratec that during 1974-79, investor-owned utilities’ forecasts 

>f peak jemand one vear ahead averaged 2.6 times the actual growth. Had 

the utilities enjoved perfect information about cash seeds and price ela- 





sticitv a decade ahead, they could in principle have avoided overshoot. 
But data and forecasting tools are grossiv umequal to this task, and 1: 
Sractice, most utilities predicted demand based on current or rolled-in 
Drices, verv low orice elasticity, and underestimated cash requirements. 


Many second-orter effects make the instability worse, including some act- 
igh capital markets and accounting methods. Utilities’ reliance 
nee for Funds Used During Construction (a fictitious, non-cash 
"come :fem now constituting about half their net in 
2 


come) makes cash-flow 
>ollapse faster if in fact the construction is not finished or if its 
Sutput cannot de soid the real cash position, aot its AFUDC-boosted 
Tacace, then dsecomes apparent he possibility, Dased on several recent 
precedents, that state Commissions may exclude unneeded plant completions 


from rate dase also heigntens the risk of not Deing made whole. 


@ould commonly proposed measures to doost cash-flow correct its instabil- 


yor ee 


itv NO. For example, putting construction work in progress (CWI?) into 











tne rate DSase azives orice elasticity longer to work during construction 
ee = 

“-:t approximates a sort of marginal-cost pricing up fronte-and thus 
increases the snort fall in revenue when the plant is completed. An 
a.eret ut tv ‘W Hh anticisatced this could of course cancel the ¢ astruce 
©Fiom, Sut then trere 2 se ano CwWl? t9 arzue adout. Sate Sased Cwl? is 
®@conmoMica.i.v sudious Secause if Rakes ratepayers Finance compulsor:iiv an 

"vestment «et 1 investors are unwilling to finance themselves. st 
S@Sises evading cne sa.utarv siscipiine of the pital tarketp.iace, it $ 
not even in et sti.sities ngeterm interest secause it would ultimatei 
mN.y increase overcapaci: 
2 wh 2 * - 7 “ a 4 =o oy . -* 9 
é 238 argument is expanced and documented in mv March 1979 qu 
= 

nference paoer “Electr . ev tuvestments: Excelsior or Conferei?” 
reorinted Soring 196 a J. Bus. Aémin. 122 mMcouver. 

<a 
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-" SMort, a Cisparity of time constants between contruction and price 
response maxes cash-flow unstable--the classi: control-theorv instability 
9s amv svstem with long lags. Reconciling the two time constants can 
-ur2 tne instadi.itv, Sut sudsidies make if sorse. it ts like having a 
-urnace controlled Sv a thermostat at the end of 2 fg corridor: the 
Sorricor will overheat before the thermostat can tel! the furnace to snut 

°f. Moving the thermostat up mext to the furnace reduces the time-laz 
amc can 2.tBinate the overshoot. Turning up tne thermostat or enlarzine 
-Se furnace merely exacerdates it 
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efi entiv (see #3 Deiow) have ied manv analivsts of energy demand to i 
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sich competition in their territories raising their own overcapacity, 
many utilicies plan to sell their surplus output to someone 21se--tradi- 
Cionally the utility next door. Today the assumed lonz-Cterm market is in 
Darticular regions, assumed to represent “black holes"--infinite inelas- 
tic marxecs for electricity, such as New England, New Yorx, Florida, Mis- 
$1SSippl, Arizona, and California. (TVA even has ambitions to wheel 
power to Arizona!) Unfortunately, a great many sale taki ar2 noping to 
seil zizantic surpluses to these same black holes simultaneously. it 

"t wo lore utilities--including many in pasaau-=pill de Seeking 19 


? 


3 ricity to an ever smaller U.S. market. There is no zZeo- 
Zraphic escape from the uncompetitiveness of the utilities’ product 


re) 
Sant was recent! 


< 


3 cont inued to cali for rate eoliet-—oneit. Jonn 
the California PUC, said, “Roger's just been telling 
Drices, 43% of your product was uncompetitive. Now 
you want higher prices so that mayde 60% or: 80% will de uncompetitive?" 
Higher prices, like higher subsidies, are worse than a merely cosmetic 
approach to the utilities’ disease; they actually reinforce it. 


Powerful market forces ar? converging on the utilities: high interest 
rates, falling ratios (current, coverage, and market, dook), increasing 
dependence ov ‘> anny money" (AFUDC) and other creative Dookkeeping, st 
nant demand, rea. cost escalation, greater consumer opposition to rate 
hixes, heavy short-term dorrowing to pay dividends, shareholder efforts 
Co prevent further dilution of equity (thus forcing even aigher debt, 
ultv ratios), and many more. These signals are not fortuitous arti- 

T t le evidence that the utilities’ financial 

l nature--bota fiscal and economic. A util- 

broke without suffering a catastrophic o2U=-stvle loss-of-cash- 
n Ly because 


09 Ssiowly ls unexoected! 


its business takes too much casn, pays It 
. 


vy price-elastic, and cannot compete. 


ifted managers would Se hard pressed to sustain such an 
the 


snpromising venture; Dut the utilitv sector is oversupplied with med:ocre 

managers, often with grievously little prospect of attracting setter 

The nottest marazement seat in industry today is finding few inspired 
axers. However this long-standing problem of management quality ts to be 
resolved, the marxet is clearly signalling that ucilities are no longer a 

sound investment. How, then can the utili 


ty sector De smoothly recycled 
Lling to buy, and how can we 
meanwn:le avoid serious dislocations in our financial system? 


Into a form whose product the market is wi 
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will enable many utilities to finance a larger energy program than 
taey had before, duct without needing to go to the market for new debt 
Ir eguity capital: they can merelv bootstrap their retained earnings 

tocalling some Sli billion a year, of which perhaps nalf is real 
money) decause the revolving fund revolves so quickly. Because the 
capital is largely or wholly internal--embedded capital already 2arn- 
ing a return--the ucility can loan at close to its embedded cost o 
money. [t e cas benefic of in a 
— 


new money from out 


: 

: : 
ginal cosc of 
national macroeconomic bDenefits 


d. Ucilities can have, at the margin, a 
I n 


ca y are no longer isk of 
pl 
investment-balancing test, is no lon 


e. All marginal investment opportunities 
are now being symmetrically compared, not 
out with the marginal cost represented by 
of the c 





apital going into the U.S. energy 
allocated as if energy were priced at the 





1¢ 
not. We have thus largely done an end-run around the awkward problem 


short time constants remove the instabi 
at r ») 


short-lead-time, fast-payback 


zZoing broke Dy building more 


s ~ C 3k 
ants than they can pay for. New construction, having failed the 
vest a ger hemorrhaging cash. 


to provide energy services 
with old cheap natural Zas, 
the proposed new plant. Most 
system is therefore being 
Margin, whether it 1 


of finding energy prices that are both equitable and efficient. 
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Service like the te 1 

do which they can do w Oo 

financial talents and existing billing r 

msaction costs. Their goal is a socia 
al 
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CO meet consumers energy service 
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. Unlike plans which rate-base conser 
d nel 


~~ e 
es the incentive to invest efficie 
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Vv 
ne housenolder, factory-owner, etc. 
t loan below the line 


ner, treating tne 
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f revenue turns out to 
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sseace-Cnrougn cos 


9f money is a wash; ¢! 


. For the next fifty vears or so, as tuey turn into a distribution 


ties have something useful to 


d about. They are using their 
_ 


Lationships to minimize 
lly efficient allocation of 
needs at least cost. 


tion loans, this scheme 
y in the hands of the party 


who is making the investment. 


protects the urtrilitv if 
The utility's 


itv’s return is 
. Vv > s+steuii +S 


changed; and the utilitv's cash-flow benefits are enormous. 
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alternatives up to the mar- 


| supply. No complex "no-losers"” test is 
required, since nonparticipants benefit instead of being penalized. 
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Keptical about doctrinal: 
ital to the national wel 


e 
to their financia! integritv; and ct 
r 


$ portant to preserve in unaitered form at 
they must de resuscitated by heroic me a notably subdsidies of the 
sind urged in the transition-team Halboutv Report from the President's 
=nergy Advisory T Fo There i. compelling evidence, on the con- 


trary 


t construction is an egregious misuse of 
nd will retard oil displacement Dy diverting 
s at would save more oil faster andc [6] 
sctant to grant rate relief uncritical! 2 
- utili s from their own folly; and that mo 
Ssidies are the surest way to ensure the Ddankruptcy or c l 
) a i the ability even of the Treasury to dai 


Should you wish to pursue these concepts further, I should be glad to 

et with you or your advisors on one of my forthcoming visits to 

on. Meanwhile, let me suggest that there is a case for setting 
out delay a small, high-powered task force of analysts who have 
ady devoted a great deal of thought to these problems. I should be 
ad to help you identify key people, mainly in the financial community, 
whose insights could be of lasting national service. If your Department 
waits until a Chrysler-like situation has actually developed, flexibility 
9f action will already be severely constrained and a large measure of the 
pudlic confidence which one had sought to preserve will alteady stand in 
jeopardy. It is vital to use this short breathing-space to develop in 
advance some prudent contingency plans. Only thus can you have at hand, 





when a politically visible crisis does loom, the background analyses you 
E will need to forestall hasty and ill-considered proposals that do not 


ull depth of the utilities’ plight. 





\ Among the most gent demonstrations that ut ties’ financial riss 
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ng part > Cc power stations in favor of eff Se renewadles invest- 
nent > . ’ ’ : f ov Regulated 














APPENDIX 3: NUCLEAR WEAPONS 


D POWER-REACTOR PLUTONIUM 279 





Tl. 


The following review article appeared in Nature 283:817- 





823, 28 February 1980. 


Nuclear weapons and 
power-reactor plutonium 


Amory B. Lovins 


Consultant Physicist. .0 Frnends of the Earth Lid. 9 Poland Street. London W!1V 30G. LK 





With modest design sophistication, nigh-burn-up plutonium from power reactors can produce powerful 
and predictable nuclear explosions. There is no way to ‘denature’ plutonium. Power reactors are not 
implausible but rather attractive as military production reactors. Current promotion of quast-civilian 
nuclear facilites rests, dangerously, on contrary assumptions. 





NUCLEAR poiicy, especially in Europe, has often been justified 
dy the Delief'” ' that for making nuclear bombs, ‘reactor-grade’ 
plutonium produced by the normal operation of uranium- 
fuelled power reactors 1s necessarily much inferior to specially 
made weapons-grade Pu: so inferior in explosive power or 
Dregictadility that sts potential use Dy amateurs is NOC a serious 
prodiem and that governments wouid instead make the higher- 
performance weapons-grade Pu in sptcial production reactors. 

Although that delief 1s faise it was vigorously asserted durin 
1978-°9 dy responsidle Ministers os by Prime Ministers in at 
east three igh-technoiogy nations. This was apparently 
Decause some of their nuclear experts did not know differently, 
and rejected contrary official US statements as being exag- 
gerated of even politically motivated: or because those experts 
who did know sere not asked. cr Decause correct technical 
advice was lost, oversimpiified, or garbled in transmission 
through advisors who did not understand the physics. Here [ 
attempt to clarify the properties and performance of various 
grades of Pu. outlining the physical logic explicitly enough to 
ensure uncerstancing aithough discreetly so as not to help the 
Malicious. certain Jetaiis and technical references have, there- 
fore, Deen omitted and some calculations treated in conclusory 
fashion 

The possible military utility of power-reactor Pu has caused 
widespread professional confusion since 1946. Although some 
leading scientists appreciated even then’ | that it was useable in 
domds of Tigh! Decome so. the contrary assumption ‘admittedly 


} _ 


’ la 
hedged! was made in the Acheson-Lilienthal report i Ais 
recommended that certain nuctear activities could Se classited 
as safe Decause the Pu they produced could net be converted 

, 


without timely warning into weapons-useable form. and that 
these activities could thus be carried out By nations if under strict 


ind enforceable international! controis With the radical 1983 
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reactor-grade Pu could be used even by amateurs to make 
effective fission bombs. albeit of somewhat reduced and 
urcertain yield*'"** Further analyses during 1976-77, mainiy at 
the US weapons laboratories, revealed a st!l wider spectrum of 
technical possibilities, and in 1977 the US announced that it 
had successfully tested a bomb made from reactor-grade Pu ~” 
Yet the earlier finding that this material, though useable, was 
inferior if used in relatively crude bomb designs was widely and 
wrongly supposed to appiy to ail designs. In particular, reactor- 
grade Pu was alleged to be inherently: 
—far more hazardous than weapons-grade Pu to people 
dealing with if; or 
—far more likely to cause unintentional explosions. or 
—incapabie of exploding violently enough to do much 
damage. or, at worst. to accompiish most military aims. 
or 
—too unpredictable in explosive yield to be acceptable to 
itS users. 
Each of these assumptions contains, in certain circumstances, 
some truth, but each is generaily, or can by plausidie counter- 
measures be rendered. false. Their :mpiication that reactor- 
grade Pu is not very dangerous. or unlikely to be attractive to 
governments, is wishful thinking, and causes the proliferation 
risks Of ‘civil’ nuclear activities to be gravely underestimated. 
in recent years, advocates of commercial Pu use, in referring 
to the Domb-making that might also result, have had to retreat 
from the original concept of denaturing to the notion of making 
do with less than optinial material” , yet the earher myth 
ingeringly distorts policy’*. To decide responsibly about 
nuclear power and auclear fuel reprocessing, we Must Know 
exactly what “less than optimal” means, and hence Tlust cau- 
tlously feview published physical principles. The only thing 
more dangerous than discussing this subject 1s not discussing it, 
the lesson of Atoms for Peace may vet be that with Pu, we must 
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Fig. 1 Tepical tora! amount and isotopic = m of 
piutonium in discharged fuel as a function of Surn-up : light- 
water reactor ~ The exact values depend in Jetail on reactor 

an mn amd on initial fuei composition. Higher 
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For a given reactor, the isotopic composition of the discharged 
Ps depends predictably on bdum-up. If each metric ton of 
sfanium TL) yields oniy a few g:gawatt-days thermai energy 
GWt-d), neutron capture is so limited that nearly pure ©’ * Pu— 
aecapons-zracde Pu—is produced. [t contains no more than 
‘or 3°o ) ** Pu, typicaily’' around 6%. perhaps 0.5% 
3. Negligible “*"Pu and ***Pu. 
gn m-up. whether through leaving the fuel in the 
reactor longer or expusiftg if tO 2 More intense neutron Aux. 
he higher Pu isotopes | Fig. | 
Low-enriched uranium fuel the usual kind) left for the fuil 
yperating LWR is usually designed for a 


ae 2 \Anoere? 
pro GULSs J af set ye} ' rtiion 


33 ver in a reliadis 


nominal sum-up of 27-33 GWtaT The latter corresponds’ ’ 
tO discharge Pu contain ing ~33% ~* Pu and 11% **'Pu i both 
fissile plus 28°, ** Pu. $95 “Pu. and 2% °*Pu This composi- 
on ts Sroadly similar for other thermal or fast reactor tvpes, 
except for grapnite-m verated rea ctors *-*""**?Py ~ 20%) and 
fast breeder radial blankets”. ~ i Insome circumstances the 


rise from 2 nominal ~29°, to as much 
18.29% 33% ** Pu, 15% °* Pui’? in equilibrium LWR Pu re- 
cycle fuel. this is unusually high and approxmates 3 practical 


5 often do. discharge fuel short of 
its fuil —— surn-up. Mature US LWR cores routinely attain 
Real 2 sumulated malfunctions. 
such as leaky fue! c! Jaddin iz. Mav 'ead the operator to discharze 
fuei at very low ¥ bura-up Alternauvely, manipulation of fue! 
rods can produce 3 core with nigh 3:erage Sura “up bul contain 
img some rods of much lower Durn-up. On-load-refueiling 
reactors such as Magno. an¢ CANDU are suitadle for clan- 
destine introduction, brief exposure. and removal of small Dut 
adequate amounts of fertile materiai in afew fuel channels. Such 
methods are 20t necessarily easy t0 detect even if an inspector 
s#ere CONntinuousiv present, and would probably not Se Gerected 
at ail by present international safeguards” 

Because burn-up, and hence isotopic composition of dis- 
charge Pu. can sary enormously Detween and within reactors 
and with time, ‘reactor-grade Pu ts not a well-defined term. 
Weapons-grade Pu, which is fairly well-defined supra), can de 
readily produced nN any power reactor without necessarily and 
significantly decreasing efficiency. increasing costs, or being 
detected But though that option ts alwavs open, we assume here 
that it is noi—that power reactors will be used to produce o7" 
high-burn- up Pu We also assume that ‘reactor-gr-.c Pu 
implies a “~'""*"Pu content of ~ 30%. higher, even. outrariiy 
higher, even-isotope content will not affect the arg’ .nent. while 
a lower content would strengthen it. On these conservative 
IssuMptions, the Pu discharged from power re .ctors wiil be 
shown to have major military potential. 


Plutonium properties 


Relevant nuclear properties of the common °u isotopes are 
summarised in Table 1. The values given for mm, are not the 
Quantities needed 70 make 3 bomb. as reutron reflection and 
implosion can reduce critical mass Dy a large factor. This facto 

has been officially stated to be ~ §. consistent with the US” no 
IAEA requirement of strict physical security measures for 
Quantities of Pu 22 kg independent of isotopic composition: 
Published data suggest, however, that with ,ophisiscated design 
the factor mav be >5. For example. in its densest 'a-phase) 
allotropic form. ***Pu at normal density in a thick Be reflector 
has a reported critical mass as smail as m, 4, and large reflector 
savings are aiso obtainabie with nonmoderating and partly 
fast-fissionable) reflectors such as ~'*U Further. if the core and 
reflector are equally compressible and if the ratio of reflector 
thickness to core radius remains constant during compression, 
critical mass varies as the inverse square of core densitv Densi- 
ties “Several times rormal are said to be attained in military 
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Por “erature Isugnlly 
sudcritical mass of a-pnase ~ “Pu in 3 U reflector can de 
compressed t0 1 $3 times its instal density, corresponding to 2 
tivity imcrease Of ~3 3 umes. The same method can vield 
en WeENer compresswons. Although Mmgh compression is in- 
msisient ith sumultaneous ugh refect ION, 1f May de possidic 
-e sigMiMc3nt supercriticalitv with inatial - Pu masses 


ic 
ancer lag Regardless of the exact figure. the [IAEA's 8-«g 
sigtiMcant Quantity design dasis for detecting diversions ~ 


seems far 100 high 
Of the Pu isotopes in Tadie I. or): °*Pu and **'Pu are fissile. 
.N3t 1s. Issionaole Ov thermal side) neutrons. All Py isotopes. 
ROwever, are Tssionadiec Dv tne [asi neutrons in abomd indecd. 
at energies > | MeV 69% of fission neutrons) the tssion <ross- 
section of **’Py .s less than that of ~’*Py by a margin of less than 
20%, $0 the amount of *’*Pu required to form a normal-density 
critscal mass ts remarkabiv insensitive to “*""-**Pu conten 
Tadic 2). Pudiished neutron transport calculations confirm that 
the csen isotopes produce only minor changes in reactivity 
eutron spectrum, and mean pri ymMpt-neutron infetume. So reac- 
tive is “* Pu that changing the ““’"-**Pu content from 6 to 30" 
No known fast- 


ncreases m., onlv from ~1i to ~i3 ke’ 
Neutron adsorber can make Pu of any practical composition 
ncapable of forming 3 prompt-critical mass*' **: calculatnons* 
suegesi that sudst:tuting the Dest fast-neutron sbrorber | Anown, 
B. for oxvgen in reactor-grade crvsial-density PuO;, m. ~ 
3$ «g) would increase m. oniy to ~ 70 kg 
F asi-"ssion properties of Pu. then. are oniv slightly affected Dy 
Wdinary changes in ssotopic composition. The reutron back- 
ground is. nowever. modestly affected. Spontaneous-fssion 
teuirons Tadie 1) provide typically * of the order of 
lyon g S$ im weapons-grade Pu. about 500 in reactor-grade 
Pa A further contribution at lower neutron energies) comes 
from 2. 2) reactions with Irent-element impur:ties. In Pu metai 
this ig Cot an umportant neutron source ©. Dut if can more than 
Soudie the teutron Dackground in PuO., as 1 Ci of a-ermutter 
somdurding o«sgen produces of the order of 5.000 15 
Neutron background from ail sources 1s significant oF 
ACIDONS DAvons infra: and Makes reactor-grade Pu gr 
somewhat Tgher radiation Joses than weapons-grade Pu For 
ong-term commercial | handling within the normal canons of 
heath oMvoeics. stieiding would de required. For clandestine 
ae€200Ns Nunufacture it sould Not, Decause the pudiished total 
Jose rates mainly v and X rays) are relatively modest —of the 


der of remnr at the surface of a 1-kg fresh recycled PuO:- 
sprere. <i mremh atl m. Even under extreme assumptions 
3 "Pu. 3! ie 4" 10-2 PuO.sonhere with suderith cal 


Mulf.diication acluded), neutron dose rates HU mremA at 


mm: do tot provide an effective deterrent [t is OOsiOUsl>s 
rrect tRat ‘$iight mustaaes in the <nowledge of exact 
sotog MOosition may sell douse extreme radwiogica! 
Mavards ° . giset normal arecautions against inadvertent crit 
3 
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ire vf act. ty tf reactor-grade u tS typically” 
~ Y gs against 3Cig for weapons-grade Pu. the neu 
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Table 2 Crimcai maw of diutoniu™m somcres nm a ~ifl-com 2aturail 
sfimium refector 3s 3 functwn of piutonium sotopsc cOmposiuon ° 
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Py in ota! Pu is 
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° Assuming Pu ~**Py ratio sumilar to rnat shown in F g 


design probiems. But realistic choices of geometry and materiais 
can readily overcome these probiems. Cooling does sot even 
become in interesting design problem until the *“Pu content 
pproaches that of a thermoelectric heat source, and a much 
ower content. well over 2s, does not provide an effective 
Jeterrent even to Most amateurs, though : would make safe and 
econor.ic fue!l-cycle operations hard to envisage” . Oniy in quite 
incompetent hands could the extra heat pose 3 danger of 
unplanned detonation 

A second ‘denaturing’ proposal bv De \ olp:'” would combine 
"Py and **"Pu with extra ““?Pu, wach is a diluent in fast spectra 
and something of a neutron poison in thermal spectra” 
Patholog:caily high “**Pu content would increase ™_, though not 
by the ~ 30 times claimed by Olds** ‘compare Table !): as ail Pu 
isotopes have “reasonadly smal! critical masses, this concept [of 
denaturing by dilution) 's not applicable to plutonium”. De 
Voip: states that fuels made mostly of -*“Pu and sith a fissile 
fraction as low as 18°» are useadle even in present fast reactors. 
but he does not analyse performance of econumuics. which 
apparently offer serious diffculties”™”. and his analssis of 
weapons MMvsics seems Jeepiy Tawed 

Synergisms are negligid the effect of each even Pu 
‘sotope can be dealt with separately: therma! denaturing with 

“Pu above and neutrons denaturing aith all three tsotopes 
below. Practicable dilution with “Pu cannot alter design con- 
straints enough to affect the conclusions below 

Finaliv, nonmetallic forms of Pu must be considered Reactor 
grade Pu can be used directly in bombs without reduction to 
metal ithough metal generally gives better performance). The 
ovvgen in Pud, dilutes the Pu and ‘engthens the genesation 
time between fssions, reducing the vield. Dut :t also slightly 
compensates Dy moderating the neutrons to lower energies 
where the fission cross-sections are higher The dilution effect 
Sredominates and rough!y doubles** the d-phase metallic ,. It 


iso Jiters other Jesign parameters. Nonetfhie'ess. (Re ote gen ts 
Not 2 Neutron purson and does cot drevent attainment of large 
reactivity coefficients and short neutron life times “ evenin the 

).. Indeed. the low initial density yp ~ 
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size ind Gentsit, "hal 2 Yeulron Dorn aithin itis like cause 2 
urimer “ss.o7 autin wt. The crimca!l masses discussed above 
Mis "Nat ime Nean distance Setween Tssvons 5 of the order of 
centimetres. tence that the ean Ime betwecen "ssvOns 15 of 
the orce "$3. Roughiv “40-30 zeneratoons of Assions are 
reguircd Suid sp 3 fast chair reactewon to 3n expiosiwve 
eve: © ¢e° = is  RWsions sould release 15 «< 10° kcal 
equai to the tom-nai energy release from ~! o«g of hugh 
CUPIOSIVeE INS INLs IPProsching the energy Jensity reeded 

disassem>.¢ vapidls 2 Pu core of nominal size. Oniv the last few 
generations om thus cxuponential process provide apprec:adie 
energy vie's That energy Suilds up. in 2 few hundredths of a 
MucTOsecond. temperatures of several Aundred millon °C and 
Sressures of tne order of 1)" Dar. causing the core to expand with 


3 ve:ocrty of the order of 10° cms. Expansion from the initia 
a factor roughis equal to the sixth root of the number 
Masses Present. that ss, bv ~ | cm, Makes the mass 
$ the chain reaction. Once the expiosion 
degins. then. only 2 few more generations of fssion. producing 
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S$ supercritical 3 Nass as 
aS Quickly 3S possibie. and 
10 mypect teulrons to mutiate the chain reaction af the optimal 

uring that assemDiv—Defore the instant of maumum 

y that tte bomd s tendency to Ay apart is partly 
countered Dv the c penne. forces of convergent assembdlv. The 
e s10N Gepends strongly on the degree of 
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supercrifticalitv aches 4 when the chain reaction is | actineed if 
"Re teutron Dackground 's so large that premutiation. defore the 
ptrmal moment, 1s likely. then the vreld varies “ as rate of 
° CTINIty oser? ”~ ’ 

Preinit n reduces vield according to the Porsson statistics 
M Aecuiron Sackzround. ind can Be counteracted Sy faster 
issemdiy Fora ant level of MaumuM reactivity insertion. 
Me provadiutys of 2.owing preiaitistion sates as] exp: teutron 
wufree siren2z’" « assem™&y cime 

Prein 2's 2 Drobiem faced Sv anv a ae DONS 
desigter using *snonahle material’ Wie -''U spon- 
fanenus “ssion rate S10 “Ag $ ), it sa mld problem, so 
asse™TINy My Me relatively slow gun method at published rates 
-<Imm us Immus inthe Hiroshima SomD) sucess But 
even weapons-grade Pu. eith neutron background 2091),000 
times Tigher ust adove ~“L), premutiates unless assembied 
molovsvely Sv a comsergent arrangement of chemical fAigh 
explosives) The cadial compression rate can then” exceed 
. MT ws 

A reflected - f Pu metal. sufficiently subcritical thar 
eutron Tuidl. fF can te Neglected. wil! Save a neutron 
Backs ec order £2 Se 10% as” of of weapons grade 
P w i of stor grad The former 4g 
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Can produce eFecitre, ugris Dower'4l weapon 
Thus can be acheeved 
the order of 10° as” 


‘ even aith 2 neutron source sirength of 
As #as omMaally appresca 

‘Al rough Quantitative analysis of the -elo- 
cities attainadle with very large charges of high explowse 
suggested that dDec2use of the strong focusing 2% 

could introduce 3 

source of neutrons into the bomb ‘for cxampie. 
¢aving the Material in an umpure state). 
the chaim reaction and attain complete 
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may mean 2 stanusucal urceriaints on 

apie range. Increasing technologies! 
tron all reduce (his uncertainty 

consider several several levels of “increasing techno- 
logical sophistication ” and their likely effects m the perform- 

ance of implosion bombs made from reactor-grade Pu or other 


compusitions’ with high neutron source strength 


Performance as a function of design 


Since construction of iiict 
tuc.car 


scrmous.s 
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i Decame pudiic Knowledge ‘nat 
weapons Dy TON-state Iad-ersaries Tlust De taKnen 
*, and that reactor-grade Pu is suitable for such 
DOMOS ** the level of technvlogs on waich most discussions 
have centred can be Cescribed 3s crude amateur Cesigns in 
ahich the normal mulstary Cesign requirements for pure oer 
material and for the symmetry, simultane:ty, and speed 
mplosion are serv considerably relaxed. The aed 
description of such designs is that of Willrich and Taylor’ 
‘Under conceivable circumstances, a few persons, possidly 
lone, who possessed ~ 1) kg of 
fantial amount of chemical high 


even One Person working 


Diutonium ouce and asuds 


explusise COuld. artfiin several weeaxs of perhaps (ess), 
Sesign and Suild a crude Assion bomb. (that! would Aave 
an excellent chance Me ex1Ddlod propabdls aith the 


ofc hemi ai high explosives. This 
ais and equipment that could be 
store and from commercial 

equipment for student 
yield as much as 20 kilotons of 


least [ON to 

Ould de Gone u haeeaes 
Surchased af a hardware 
supplier of scientific 
aboratories It} mighe 


puwer of at 


explosive Dower —the equal of the Nagasax: A-bomo 
though the probatility of such 3 high ie¢id is quite small] 
very sophisticated thermal-Asdrauiic and neutron cail- 


t be needed. Several suitabiv comorenen 
fact Deen conducted *v amateurs 
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MOL 2 clever tecRhnolcgy  wMpier Means can produce Oetler 
Tesulfs) Dui is Dasic and relsatiec. and 235 Deen the subject of 
verai amateur Gesign evercses Fue Sustinguished suciear 
weapons ciperts concluded thar using weapons-grade Pu or 
L yw . 27 » err med a Os 
1 18 DOSSIDIe to design ‘ow-technolog, Sevices that 
aOu.3 Teh IMy Produce explosive sicids sp to the equi alent 


. Var YY ~ ‘T T 4 °™ - - — 
M10 of 20 kilotons of TNT. Witn reactor- grace piutonim «1 


vieics 3-10 tumes Oeer than tnose mentored abe 
Sepending on the Jesigny. Dut yields in the «:loton range 


could be accomplished Miltary useful seapons «ith 

reucdie 2uclear y:elus 12 the &:loton ange <3n (hercfore de 
° 4 ' . » . - — - . 

on si ucteédg surg + ECNNOs <> ins e323 ct r-g> 3ce piu 
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This ss consistent with De Voip:'s Tadle L-4 resuits’”. gwen 
Teaiustic cRowes Of parameters.) As for the resources required 
asmail group of people. none of whom have ever had 3ccess to 
the classited iterature ©. could get by with “modest machine- 


sROD facuities (Nhat cOuls Se contracted ’or without 2rousing 
wo 


SUSPICION snc 4119 “Iiraction perhaps a small fraction: of a 
nT mM SOURIS [OF ODeEN-Maraect equipment” 


Recently declassiMed Jocuments ceaiing with 1955 US tech- 


guite precise Juantstatise formation 
ects of Now ‘he probability CistriDution of nuclear 


e ~> « anges Ath tre sotoo SOM Dusition yf the Diu- 
Imium used This information makes clear that ath 


pOwe! Teactor grace PiutoniuMm. an imMpiosion weapon of 
even the simpie kind first used bv the US would reliabiy 


have vieids Detween | and I) kton 
Pre:mitiation at the ‘east favourable moment “na Trimty-tyoe 
-omo would stil! produce reliable kiloton sields the «sors! 
case. Tumimum. Azzie yreld ts stl! a militarily useful 
~\ «ton. This Sehascour ts Chiefly a function of assemoly rate 


MOH Yeulron Jacaground. decause the ‘cast favourabie NomMent 
cannot get any less favourable. The same conciusion would 
ly Migh neutron source 
strength. as from ‘a large fraction’ of ““’Pu ‘ref 46) and high 
"Pu ref 37). Contrary to Mever eral.*’, “slight mistakes in the 
KMNowledge of exact sotopr composition” could tot “lead to 
neutralisation of the explosive Gesign and could indeed de 


eadily accommodated bv design 
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thought. we 108 Know that cen sumpic ‘Level Teo 
Sesigns, 2iDd]:t with some uNce:srauntics in vi|esd, CAN ET+e Ss 


effective. hughiy SO¥eriul @c3pOts—reliabis in the aloton 


The :talicrsed passages imply that further icveis of technology 
eust ath sail higher seid and predictabiity than Leve! Tao 
A third level! of technology seeks 10 Overcome Dremutiation Ds 
extremely raped assembiv The necessary rates of 2ssemdi» <an 
¢ c3iculated and seem to be readily attainatie. One pudinshed 
son. for example. ss stated to de able 10 Compress 2 
sizeable core af several tumes the Immyus § sadiai r3te 
menisoned earlier. Far tugher rates are possidie aith tnrs 
method. Declause (8 2 CONvergent umplosive sysiem. shock Dres- 
sures vary roughly 3s the inverse fourth power of radius and 
shock velocities 35 the inverse square of radius. Applying the 
same design to 3 smail core can therefore achieve such gr 
assembly velocities that the shock can traverse much of the core 
and insert very sudsiantial reactivity before hydrodynamic dis- 
assembly forces can dominate. The probability of premutiation 
then becomes smail. the expected yield relatively iarge. and its 
Gispersion smail in short, the performance penalty approaches 
the “imsign«Ncant 
Calculations suggest that this Level Three technology ss 
suMcient. using reactor-grade Pu. for almost any muiitary 
Objects | even with attempted “denaturing © The method ail 
readily occur tO NOS governments and ‘oO Many technically 
informed amateurs. The apparatus is ot unduly difficult to 
achieve. It Joes not necessarily involve a higher technology than 
Levei Two. and should be considered more a logical extension of 
Level One. a smart amateur design , than the exclusive province 
of governments. [t does aot necessarily require nuclear testing to 
eMsure confidence in obtaining high vie'd. provided the Maker 15 
conndent that the weil-charactertsed 2on-nucicar components 
ail function us designed. Non-nuclear test Srings would, of 
course, increase this confidence 
Most military 5ombs are required to function sormaily in Aigh 
QNeuiron fuxes such as might arse from nearby auclear 
explosions. Essentially the same design considerations appiv as 
nthe case of hig internal veutron source strengths. It can be 
safely Oresumec ‘hat these probiems ire routineiy Overcome Dv 
various Means. inciuding thermonuciear techniques that could 
render the penalty from using reactor-grade Pu sot oniy very 
smaii but nul, even at very Aigh vields. This is a verv high 
technology requiring elaporate ‘heoretical, computational. and 
fabrication faciiities, together wh pror nuciear testing But 
such sophistication is not required for governments or even for 
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A government can esther manipulate avi ‘uel cycles "0 produce 
suPsiantial amounts of low-durn-up diutonium, or, espec:aily 
using Level Three technology. use tigh-Durn-up Pu in bomes 
with insigtificant performance penalty. Regardless of possibie 
technical measures**** ******, such Pu will become readils 
available im quantities of the order of 10°-10° m. vr”, and 

extracted forms useable for weapons within hours or days. ¢f 
pians proceed for commercial reprocessing, hich is unsafe 
guardable both today” and in pr seen’ NMMaking even 
hugh-burn-up Pu :n domestic Dower reactors incurs NO penaity in 
reactor eMcency of in equipment costs. 3a reactor-exporting 
country will gladiv build the reactor, train the technicians, anc 
pav for the whole package with generous export sudsidies. If 
extracted, and using any of the numerous means of evading 


effective safeguards. the Pu discharged from a single large power 
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